{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/cover-both-iam-version-actions-when-denying-managed-policy-changes/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/",
        "slug": "cover-both-iam-version-actions-when-denying-managed-policy-changes",
        "url": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/cover-both-iam-version-actions-when-denying-managed-policy-changes/"
        },
        "title": "Cover both IAM version actions when denying managed-policy changes",
        "summary": "Blocking SetDefaultPolicyVersion alone leaves a separate API path for creating and activating a new policy version.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:13:46+00:00",
        "modified_at": "2026-10-20T18:34:29+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 272,
        "potentially_affected": "Review default-version change authority for customer managed IAM policies; customers cannot select the default for AWS managed policies or inline policies.",
        "dse_recommendation": "DSE recommends reviewing both API paths when the requirement is to prevent a principal from changing an attached policy's effective permissions.",
        "primary_source": {
            "name": "AWS Documentation",
            "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Blocking SetDefaultPolicyVersion alone leaves a separate API path for creating and activating a new policy version.</p>\n<h2>Source facts</h2>\n<p>IAM CreatePolicyVersion can create a managed-policy version and set it as default. SetDefaultPolicyVersion can make an existing version the default. AWS says both actions must be denied to prevent a user from changing the default policy version. The default is the operative version for all users, groups and roles attached to that managed policy.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html\">AWS Documentation</a>.</p>\n<h2>Applicability</h2>\n<p>Review default-version change authority for customer managed IAM policies; customers cannot select the default for AWS managed policies or inline policies.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends reviewing both API paths when the requirement is to prevent a principal from changing an attached policy&#8217;s effective permissions. Inventory direct and inherited grants for the policy administrator and identify the exact customer managed policy resources within scope. Keep the proposed restriction targeted to that approved population rather than copying a deny across every policy merely to solve one access-control requirement. Have the policy owner review which attached identities would receive a newly selected default. Record the current default version before a controlled test and distinguish editing a saved document from making that document operative. Give policy-version administration an explicit owner and verify both paths whenever the restriction changes.</p>\n<h2>Verification</h2>\n<p>Proposed verification: on a disposable customer managed policy, compare permission to select an existing default with permission to create a version using the set-as-default option. Then test the intended restriction on both actions and inspect the actual default version after each attempt. Retain identifiers and authorization outcomes without exercising this change against a production policy.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html\">AWS Documentation</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Blocking SetDefaultPolicyVersion alone leaves a separate API path for creating and activating a new policy version.\nSource facts\nIAM CreatePolicyVersion can create a managed-policy version and set it as default. SetDefaultPolicyVersion can make an existing version the default. AWS says both actions must be denied to prevent a user from changing the default policy version. The default is the operative version for all users, groups and roles attached to that managed policy.\nSource: AWS Documentation.\nApplicability\nReview default-version change authority for customer managed IAM policies; customers cannot select the default for AWS managed policies or inline policies.\nDSE recommendation\nDSE recommends reviewing both API paths when the requirement is to prevent a principal from changing an attached policy’s effective permissions. Inventory direct and inherited grants for the policy administrator and identify the exact customer managed policy resources within scope. Keep the proposed restriction targeted to that approved population rather than copying a deny across every policy merely to solve one access-control requirement. Have the policy owner review which attached identities would receive a newly selected default. Record the current default version before a controlled test and distinguish editing a saved document from making that document operative. Give policy-version administration an explicit owner and verify both paths whenever the restriction changes.\nVerification\nProposed verification: on a disposable customer managed policy, compare permission to select an existing default with permission to create a version using the set-as-default option. Then test the intended restriction on both actions and inspect the actual default version after each attempt. Retain identifiers and authorization outcomes without exercising this change against a production policy.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.",
        "content_markdown": "Blocking SetDefaultPolicyVersion alone leaves a separate API path for creating and activating a new policy version.\n\n## Source facts\n\nIAM CreatePolicyVersion can create a managed-policy version and set it as default. SetDefaultPolicyVersion can make an existing version the default. AWS says both actions must be denied to prevent a user from changing the default policy version. The default is the operative version for all users, groups and roles attached to that managed policy.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html).\n\n## Applicability\n\nReview default-version change authority for customer managed IAM policies; customers cannot select the default for AWS managed policies or inline policies.\n\n## DSE recommendation\n\nDSE recommends reviewing both API paths when the requirement is to prevent a principal from changing an attached policy’s effective permissions. Inventory direct and inherited grants for the policy administrator and identify the exact customer managed policy resources within scope. Keep the proposed restriction targeted to that approved population rather than copying a deny across every policy merely to solve one access-control requirement. Have the policy owner review which attached identities would receive a newly selected default. Record the current default version before a controlled test and distinguish editing a saved document from making that document operative. Give policy-version administration an explicit owner and verify both paths whenever the restriction changes.\n\n## Verification\n\nProposed verification: on a disposable customer managed policy, compare permission to select an existing default with permission to create a version using the set-as-default option. Then test the intended restriction on both actions and inspect the actual default version after each attempt. Retain identifiers and authorization outcomes without exercising this change against a production policy.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/",
                "url": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Cover both IAM version actions when denying managed-policy changes",
                        "item": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/#article",
                "identifier": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/",
                "url": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/",
                "headline": "Cover both IAM version actions when denying managed-policy changes",
                "description": "Blocking SetDefaultPolicyVersion alone leaves a separate API path for creating and activating a new policy version.",
                "abstract": "Blocking SetDefaultPolicyVersion alone leaves a separate API path for creating and activating a new policy version.",
                "articleBody": "Blocking SetDefaultPolicyVersion alone leaves a separate API path for creating and activating a new policy version.\nSource facts\nIAM CreatePolicyVersion can create a managed-policy version and set it as default. SetDefaultPolicyVersion can make an existing version the default. AWS says both actions must be denied to prevent a user from changing the default policy version. The default is the operative version for all users, groups and roles attached to that managed policy.\nSource: AWS Documentation.\nApplicability\nReview default-version change authority for customer managed IAM policies; customers cannot select the default for AWS managed policies or inline policies.\nDSE recommendation\nDSE recommends reviewing both API paths when the requirement is to prevent a principal from changing an attached policy’s effective permissions. Inventory direct and inherited grants for the policy administrator and identify the exact customer managed policy resources within scope. Keep the proposed restriction targeted to that approved population rather than copying a deny across every policy merely to solve one access-control requirement. Have the policy owner review which attached identities would receive a newly selected default. Record the current default version before a controlled test and distinguish editing a saved document from making that document operative. Give policy-version administration an explicit owner and verify both paths whenever the restriction changes.\nVerification\nProposed verification: on a disposable customer managed policy, compare permission to select an existing default with permission to create a version using the set-as-default option. Then test the intended restriction on both actions and inspect the actual default version after each attempt. Retain identifiers and authorization outcomes without exercising this change against a production policy.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:13:46+00:00",
                "dateModified": "2026-10-20T18:34:29+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/cover-both-iam-version-actions-when-denying-managed-policy-changes/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Cover both IAM version actions when denying managed-policy changes"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 272,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS Documentation",
                    "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html"
                }
            }
        ]
    }
}