iam:UpdateLoginProfile Privilege Escalation

iam:UpdateLoginProfile resets the console password of an IAM user that already has a login profile. An attacker resets the password of a more-privileged user, then signs in to the console as that user — unless the target is protected by MFA.

Permissions an attacker needs

iam:UpdateLoginProfile

How the escalation works

The attacker enumerates IAM users and finds one with broad permissions that has a console login profile.
They call UpdateLoginProfile to set a new password they control.
They sign in to the AWS console as that user and inherit its privileges.

Example vulnerable policy

A policy like this grants the dangerous permission. Paste your own policy into the free AI-Powered IAM analyzer to see if you are exposed.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:UpdateLoginProfile",
      "Resource": "*"
    }
  ]
}

Example exploitation

For illustration only — run against accounts you own or are authorized to test.

aws iam update-login-profile \
  --user-name privileged-admin \
  --password 'N3w-Passw0rd!' \
  --no-password-reset-required

How to detect and prevent it

Scope iam:UpdateLoginProfile to specific users and never grant it on Resource "*".
Require MFA on every human user — a reset password alone cannot complete sign-in when MFA is enforced.
Alert on UpdateLoginProfile and CreateLoginProfile in CloudTrail; a password set on another principal is a strong escalation signal.

FAQ

Does MFA stop this escalation?

It blocks the final step. The attacker can still reset the password, but cannot complete console sign-in without the second factor — which is why MFA on every human user is the key control.

Related escalation methods

Check your IAM policies for this — free

Shieldly's AI-Powered analyzer flags privilege-escalation paths, wildcards, and risky PassRole in seconds. No signup, no AWS credentials. Also ships as CLI, VS Code extension, GitHub Action, and CDK Guard.

Amazon Web Services (AWS) is a trademark of Amazon.com, Inc. Shieldly is not affiliated with, endorsed by, or sponsored by Amazon Web Services.