AWS IAM Trust Policy Backdoor via UpdateAssumeRolePolicy

Lacey Cochrane@NullVectorX

•updated Jul 7, 2026•11•0•26

Detects the modification of an existing IAM role's trust policy to include new trusted principals (external AWS accounts, root principals, or wildcards). This technique is used for persistence and privilege escalation by modifying existing roles to allow access by an attacker-controlled principal, effectively bypassing detections focused on the creation of new roles.