Cloud Security 101: Detecting AWS IAM Attacks

Modern cloud breaches rarely touch an endpoint. They start with a leaked long-lived access key and escalate quietly through IAM - fast, and easy to miss if you're only watching hosts.

The typical path

1. Access - a key leaks (committed to a repo, in a config, phished).
2. Recon - enumerate permissions (GetCallerIdentity, ListRoles, ListPolicies).
3. Escalate - attach an admin policy or mint new credentials.
4. Persist / exfil - create access keys, share snapshots/buckets externally.

The CloudTrail events to alert on

• CreateAccessKey for a user who shouldn't be minting keys - especially on another user.
• AttachUserPolicy / PutUserPolicy granting AdministratorAccess.
• PutBucketPolicy / PutBucketAcl granting Principal: * (public exposure).
• Snapshot / AMI sharing with an external account ID.
• ConsoleLogin from a root account, or without MFA.

Reduce the blast radius

Prefer short-lived credentials (roles, SSO) over long-lived keys, enforce MFA, enable IMDSv2 to blunt SSRF-to-metadata, and alert on the escalation events above. In the cloud, your audit log is your endpoint.