Mis-scoped AWS Organizations Policy Allowed Hackers to Seize Full Control of AWS Environment

Security professionals have uncovered serious vulnerabilities in AWS Organizations in a ground-breaking study by Cymulate Research Labs that might allow attackers to switch between accounts, increase privileges, and take control the entire organization.l takeover.

The research focuses on how misconfigured delegation mechanisms intended as a best practice for distributing administrative tasks can be weaponized by adversaries to exploit legitimate features for persistence and lateral movement in multi-account environments.

Despite AWS’s promotion of delegated administrators to reduce reliance on the highly privileged management account, these setups introduce subtle attack surfaces if not properly secured.

Uncovering Hidden Vulnerabilities

For instance, compromising a delegated admin account grants organization-wide visibility into accounts and OUs, allowing attackers to map high-value targets and plan sophisticated escalations.

The study highlights services like AWS IAM Identity Center (formerly SSO) and CloudFormation StackSets as particularly sensitive, where delegation abuse could alter permission sets or deploy malicious stacks across all member accounts, effectively granting god-like control.

At the heart of the findings is a previously unidentified over-scoped permission in the original AmazonGuardDutyFullAccess managed policy (version 1), which inadvertently permitted principals in the management account to register delegated administrators for any supported service, not just GuardDuty.

This flaw stemmed from the unrestricted “organizations:RegisterDelegatedAdministrator” action, allowing attackers with a compromised credential in the management account to delegate sensitive services like IAM Identity Center or CloudFormation StackSets to a controlled member account.

A High-Impact Policy Flaw

In a simulated exploit, researchers demonstrated how an attacker could start with limited access such as leaked keys from a GuardDuty management role delegate SSO to a compromised workload account, then manipulate organization-wide groups and permission sets to gain administrative access even to the management account itself.

This chain could lead to complete compromise, including deploying backdoors via StackSets or resetting credentials for persistence, all while evading detection by mimicking legitimate administrative actions.

AWS has addressed the issue by releasing AmazonGuardDutyFullAccess_v2, which scopes the delegation permission strictly to GuardDuty, eliminating the escalation path.

The company proactively notified affected customers via email and Health Dashboard, emphasizing the need to manually update roles and users from v1 to v2, as automatic upgrades were avoided to prevent disrupting workflows.

Starting August 26, 2025, attachments to the old policy will be blocked, though existing ones remain active until updated.

According to the Report, Cymulate’s team praised AWS’s collaborative response through coordinated disclosure, underscoring the importance of such partnerships in securing cloud ecosystems.

To mitigate these risks, organizations are urged to audit all delegations, mapping delegated accounts and services to classify them by sensitivity tiers treating IAM Identity Center delegations as Tier 0 assets with stringent controls.

Monitoring CloudTrail for events like RegisterDelegatedAdministrator and simulating attack scenarios in controlled environments can reveal gaps in defenses.

Cymulate has released an attack simulation tool combining delegation abuse with the policy exploit, enabling teams to test and optimize detection.

By reevaluating delegation configurations and enforcing least-privilege policies, AWS users can transform these potential weaknesses into robust security postures, turning a cautionary tale into an opportunity for enhanced resilience in multi-account setups.

This research not only illuminates overlooked vectors but also empowers defenders to stay ahead in the evolving cloud threat landscape.

Stay Updated on Daily Cybersecurity News. Follow us on Google News, LinkedIn, and X.