AssociateIamInstanceProfile
AWS
AssociateIamInstanceProfile
Event
Associates an IAM instance profile with an EC2 instance, potentially attaching a high-privilege role to an attacker-controlled instance.
Security Context
- Attaching an IAM instance profile grants the EC2 instance all permissions of the associated role, enabling an attacker with instance access to escalate privileges by associating a more powerful role.
- This technique is commonly used after gaining initial access to an EC2 instance to pivot from limited instance permissions to broader account-level access.
Log Source
CloudTrail
Sample Event
Adversarial. Draco — having gained shell access to an OCCAMY pipeline EC2 instance (assume via a separate exploit) — uses his compromised IAM user to associate the higher-privileged GraphornAdminRole (via its instance profile) with the running instance. He can now use the EC2 instance metadata service to mint admin-scope STS credentials from inside the instance. This is a classic credential-elevation pivot that survives the EC2’s existing role’s least-privilege bounds.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T20:27:09Z", "eventSource": "ec2.amazonaws.com", "eventName": "AssociateIamInstanceProfile", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "iamInstanceProfile": { "arn": "arn:aws:iam::555123456789:instance-profile/GraphornAdminInstanceProfile" }, "instanceId": "i-0occamy0000000001" }, "responseElements": { "requestId": "90000000-0000-4000-8000-000001101100", "iamInstanceProfileAssociation": { "associationId": "iip-assoc-0666666666666666f", "instanceId": "i-0occamy0000000001", "iamInstanceProfile": { "arn": "arn:aws:iam::555123456789:instance-profile/GraphornAdminInstanceProfile", "id": "AIPAGRAPH0RNADM1NPR0F" }, "state": "associating" } }, "requestID": "90000000-0000-4000-8000-000001101100", "eventID": "90000000-0000-4000-8000-000001101101", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Privilege Escalation
Techniques:
- T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include accoun...