ReplaceIamInstanceProfileAssociation
AWS
ReplaceIamInstanceProfileAssociation
Event
Replaces the IAM instance profile associated with a running EC2 instance with a different one.
Security Context
- Using valid cloud accounts allows adversaries to blend in with legitimate activity while accessing sensitive resources.
- Abusing elevation control mechanisms allows adversaries to bypass intended access restrictions and operate with higher privileges.
Log Source
CloudTrail
Sample Event
Adversarial. Draco — using credentials from a session he established on an EC2 instance he was authorized to interact with — replaces the legacy OccamyPipelineRole instance profile on i-0occamy0000000001 with the elevated GraphornAdminRole instance profile. Once attached, any process on the instance reading IMDS gets admin-equivalent credentials. Requires iam:PassRole on the target profile + ec2:ReplaceIamInstanceProfileAssociation. T1548 (privesc through abusing elevation control mechanism).
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "ASIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T19:48:33Z", "eventSource": "ec2.amazonaws.com", "eventName": "ReplaceIamInstanceProfileAssociation", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "ReplaceIamInstanceProfileAssociationRequest": { "AssociationId": "iip-assoc-0graph0rnasc00001", "IamInstanceProfile": { "Arn": "arn:aws:iam::555123456789:instance-profile/GraphornAdminRole" } } }, "responseElements": { "ReplaceIamInstanceProfileAssociationResponse": { "iamInstanceProfileAssociation": { "associationId": "iip-assoc-0graph0rnasc00010", "instanceId": "i-0occamy0000000001", "iamInstanceProfile": { "arn": "arn:aws:iam::555123456789:instance-profile/GraphornAdminRole", "id": "AIPAGRAPH0RN1NSTPR0F1" }, "state": "associating", "timestamp": "2026-04-15T19:48:33Z" } } }, "requestID": "90000000-0000-4000-8000-000110011110", "eventID": "90000000-0000-4000-8000-000110011111", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Privilege Escalation
Techniques:
- T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include accoun...