Permissions Boundary Removal for Self-Escalation (IAM-022)
aws-iam-privesc-delete-user-permissions-boundary
Attack path
IAM principal
IAM actions
iam:DeleteUserPermissionsBoundary
Rewrite IAM policy
Elevated permissions
Privilege escalation
Schematic attack path derived from the query definition. See the full write-up via the attribution link below.
Required IAM permissions
iam:DeleteUserPermissionsBoundary
Summary
IAM users that can remove their own permissions boundary, if one is attached.
Description
Find IAM users whose policies allow iam:DeleteUserPermissionsBoundary on their own user ARN. The graph does not record whether a boundary is attached or whether removing it grants more access, so each result needs manual review.
openCypher query
// Find IAM users with iam:DeleteUserPermissionsBoundary permission
MATCH path_principal = (aws:AWSAccount {id: $provider_uid})--(principal:AWSUser)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {effect: 'Allow'})
MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
WHERE toLower(act.value) IN ['iam:*', 'iam:deleteuserpermissionsboundary']
OR act.value = '*'
WITH DISTINCT principal, stmt, path_principal
// Keep only users that can remove the boundary from their own user ARN
MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
WHERE res.value = '*'
OR res.value = principal.arn
OR (res.value ENDS WITH '*' AND principal.arn STARTS WITH replace(res.value, '*', ''))
WITH DISTINCT path_principal
WITH collect(path_principal) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:ProwlerFinding {status: 'FAIL'})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfrFull attack path write-up
pathfinding.cloud - IAM-022 - iam:DeleteUserPermissionsBoundary