Analytics BIOC Low
✕

AWS IAM Role's Trusted Policy Modification Allows Cross-Account Access

A cloud identity has updated an IAM role's trust policy to allow external AWS account access.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Account Manipulation: Additional Cloud Roles (T1098.003) Account Manipulation (T1098)
Attacker's goals:

Obtaining persistency by assuming a role in the target's environment.

Investigative actions:

Investigate any unusual activity originating from the suspected identity. Investigate any unusual activity performed in the assumed role sessions when originating from the allowed added accounts. Validate the legitimacy of the AWS accounts that were allowed external access.

Test period:
N/A (single event)
Deduplication:
5 Days