Privilege escalation IAM T1098.003 Persistence

Roll back default policy version

Can roll an attached managed policy back to a more-permissive saved version.

Grants escalation on its own.

iam:SetDefaultPolicyVersion

Key takeaway

On its own, iam:SetDefaultPolicyVersion can roll an attached managed policy back to a more-permissive saved version. On a wide resource scope that alone reaches administrator access.

How an attacker moves from this permission.

Explore this in Pathbreak

Why it is dangerous

A principal can call iam:SetDefaultPolicyVersion on attached customer-managed the policy to promote one of its non-default stored versions to the default. IAM keeps up to five versions of a policy; if an older, more-permissive version exists (for example a prior admin grant), rolling it back to default silently widens the effective permissions of every the principal is attached to, including the principal itself, with no new policy document written. AWS-managed policies cannot be versioned, so only customer-managed policies are targeted.

In MITRE ATT&CK terms this maps to T1098.003, Account Manipulation: Additional Cloud Roles, under the privilege escalation tactic. AWS records it in CloudTrail as SetDefaultPolicyVersion. The call shows up in CloudTrail but blends into normal administration, so it needs a rule to stand out. It also gives an attacker a way to keep access after the first foothold is closed, so it is worth watching even when it looks like routine administration.

Detection

SetDefaultPolicyVersion

Prerequisites

A customer-managed policy attached to the principal that has a more-permissive non-default version stored. ENGINE CAVEAT: the engine only evaluates the current default version, so it cannot confirm the rollback target is more permissive, the edge is a needs-verification over-approximation.

MITRE ATT&CK

T1098.003 · Account Manipulation: Additional Cloud Roles

Tactic

Privilege Escalation

Breaking the path

A control that would remove it: Remove iam:SetDefaultPolicyVersion from the principal; prune stale permissive policy versions.

Whether to apply it depends on how the permission is used in your environment, so it is a business decision rather than an automatic fix. The same permission can be load-bearing in one account and pure risk in another.

Pathbreak confirms whether this path resolves in your account, ranks it against the others by how much it opens up, and uses your threat model and business context to show which paths are worth cutting.

Questions

What does iam:SetDefaultPolicyVersion allow?

Can roll an attached managed policy back to a more-permissive saved version.

Can iam:SetDefaultPolicyVersion escalate privileges on its own?

Yes. Held on a broad enough resource it reaches administrator access with no other permission.

How is roll back default policy version detected?

Watch for SetDefaultPolicyVersion in CloudTrail. The call shows up in CloudTrail but blends into normal administration, so it needs a rule to stand out.

How do you break this path?

A control that would remove it is: Remove iam:SetDefaultPolicyVersion from the principal; prune stale permissive policy versions. Whether to apply it depends on how the permission is used in your account, so it is a business decision rather than an automatic fix.

Which MITRE ATT&CK technique is this?

T1098.003, Account Manipulation: Additional Cloud Roles, under the privilege escalation tactic.

References

https://attack.mitre.org/techniques/T1098/003/

Find this in your own account

We run a read-only scan of one AWS account and show you which of these paths exist, ranked by blast radius, with the change that breaks each one. First validated paths within the hour.

Request a free scan Watch the 7-minute walkthrough