Last reviewed:
Identify identity-abuse patterns in AWS IAM, including role assumption abuse, access key enumeration and risky policy changes for SOC detection teams.
Identity and Access Management (IAM) is the primary target for attackers seeking long-term persistence or data access in AWS. Detection focuses on identifying administrative actions that deviate from established patterns, particularly those involving identity transitions or permission escalations.
Attackers use sts:AssumeRole to move laterally or hide their origin. Monitor for role assumptions coming from unexpected source IP addresses, particularly those not associated with your known office ranges or internal VPC endpoints.
A sudden increase in assumptions for high-privileged roles by historically low-privileged users is a strong indicator of compromise. Pay close attention to calls where the SourceIdentity or RoleSessionName parameters contain unusual strings or patterns that do not match your standard naming conventions.
Long-lived access keys remain a frequent source of exposure. Detecting abuse involves looking for 'enumeration' behaviour where a single key is used to call a wide variety of Describe and List actions across multiple services in a short window.
Be alert for GetCallerIdentity followed immediately by attempts to list S3 buckets or IAM policies. This suggests an attacker is orientating themselves after a credential theft. If an access key is used from a geographic location or an ISP that has never appeared in your logs for that specific identity, treat it as a high-severity alert.
Risky policy changes often precede data exfiltration or privilege escalation. Make sure you are alerted whenever the AdministratorAccess policy is attached to a new user, group, or role.
Similarly, monitor for the creation of new IAM policy versions that weaken security controls, such as adding '*' permissions or allowing iam:PassRole to arbitrary targets. Attackers may also try to create new access keys for existing users (CreateAccessKey) to ensure they maintain access if their initial entry point is discovered.
Start with these specific event monitors to identify IAM abuse in its early stages.