Cover both IAM version actions when denying managed-policy changes

Blocking SetDefaultPolicyVersion alone leaves a separate API path for creating and activating a new policy version.

Source facts

IAM CreatePolicyVersion can create a managed-policy version and set it as default. SetDefaultPolicyVersion can make an existing version the default. AWS says both actions must be denied to prevent a user from changing the default policy version. The default is the operative version for all users, groups and roles attached to that managed policy.

Source: AWS Documentation.

Applicability

Review default-version change authority for customer managed IAM policies; customers cannot select the default for AWS managed policies or inline policies.

DSE recommendation

DSE recommends reviewing both API paths when the requirement is to prevent a principal from changing an attached policy’s effective permissions. Inventory direct and inherited grants for the policy administrator and identify the exact customer managed policy resources within scope. Keep the proposed restriction targeted to that approved population rather than copying a deny across every policy merely to solve one access-control requirement. Have the policy owner review which attached identities would receive a newly selected default. Record the current default version before a controlled test and distinguish editing a saved document from making that document operative. Give policy-version administration an explicit owner and verify both paths whenever the restriction changes.

Verification

Proposed verification: on a disposable customer managed policy, compare permission to select an existing default with permission to create a version using the set-as-default option. Then test the intended restriction on both actions and inspect the actual default version after each attempt. Retain identifiers and authorization outcomes without exercising this change against a production policy.

Official reference

AWS Documentation. Reviewed October 20, 2026.