IAM user has excessive iam:CreateLoginProfile permissions

Description

iam:CreateLoginProfile can set a console password for an IAM user that has no login profile yet. If the target is privileged and other sign-in controls permit access, the new login path can expose that user’s permissions.

Potential impact

• An unintended user may gain console access to a privileged account.
• Credentials can be issued outside approved account-administration procedures.

Remediation

Remove iam:CreateLoginProfile permission from users who do not administer login profiles. Limit required access to approved target users, audit profile creation, and maintain other sign-in controls such as MFA.

Examples

The examples replace login-profile creation with EC2 describe permissions for the same user. Changing this policy does not remove profiles or passwords already created.

Before

resource "aws_iam_user" "example" {
  name = "cosmic"
}

resource "aws_iam_user_policy" "example" {
  name = "test_inline_policy"
  user = aws_iam_user.example.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "iam:CreateLoginProfile",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

After

resource "aws_iam_user" "example" {
  name = "cosmic"
}

resource "aws_iam_user_policy" "example" {
  name = "inline_policy_read_only"
  user = aws_iam_user.example.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "ec2:Describe*",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

References

• CWE-269
• Terraform AWS iam_user_policy documentation