Description
Broad iam:UpdateLoginProfile permission lets group members change other IAM users’ console passwords. Access to a more privileged target account can lead to privilege escalation.
Potential impact
Changing a password can disrupt the user’s access or enable misuse of their permissions where other sign-in controls allow it.
Remediation
Remove this permission from groups that do not manage passwords. Limit necessary help-desk or administrator permissions to approved target users and maintain MFA.
Examples
The examples replace password-changing permission with EC2 describe permissions for the same group. Permission to change a password does not itself disable MFA.
Before
hcl
resource "aws_iam_group" "example" {
name = "cosmic"
}
resource "aws_iam_group_policy" "example" {
name = "test_inline_policy"
group = aws_iam_group.example.name
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = [
"iam:UpdateLoginProfile",
]
Effect = "Allow"
Resource = "*"
},
]
})
}
After
hcl
resource "aws_iam_group" "example" {
name = "cosmic"
}
resource "aws_iam_group_policy" "example" {
name = "inline_policy_run_instances"
group = aws_iam_group.example.name
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = [
"ec2:Describe*",
]
Effect = "Allow"
Resource = "*"
},
]
})
}