CreatePolicyVersion
AWS
CreatePolicyVersion
Event
Creates a new version of an IAM managed policy, which can optionally be set as the default active version.
Security Context
- Creating a new policy version with the set-as-default flag immediately applies the updated permissions to all principals attached to the policy, enabling silent privilege escalation.
- This is a well-known IAM privilege escalation path where an attacker with iam:CreatePolicyVersion can grant themselves administrative access without creating new roles or users.
Log Source
CloudTrail
Sample Event
Adversarial. Draco — having compromised a session that holds iam:CreatePolicyVersion on the existing OccamyPipelineLeastPrivilege policy — creates a new version of the policy whose document is Allow * * and immediately sets it as the default with setAsDefault: true. Every principal currently attached to the policy (the OCCAMY pipeline role, perhaps multiple users) is silently elevated to admin without modifying any role-policy or user-policy attachments.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-16T00:24:51Z", "eventSource": "iam.amazonaws.com", "eventName": "CreatePolicyVersion", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "policyArn": "arn:aws:iam::555123456789:policy/OccamyPipelineLeastPrivilege", "policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":\"*\",\"Resource\":\"*\"}]}", "setAsDefault": true }, "responseElements": { "policyVersion": { "versionId": "v2", "isDefaultVersion": true, "createDate": "Apr 16, 2026, 12:24:51 AM" } }, "requestID": "90000000-0000-4000-8000-000010011000", "eventID": "90000000-0000-4000-8000-000010011001", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "iam.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Privilege Escalation
Techniques:
- T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include accoun...