Detection of Anomalous AWS DynamoDB Scan Operations

This threat brief addresses the risk of unauthorized data collection and potential exfiltration from AWS DynamoDB tables. Adversaries who have compromised an IAM identity may attempt to use the DynamoDB Scan operation to dump large portions of a database, bypassing granular queries to exfiltrate entire table contents. This activity is monitored by tracking Scan operations within AWS CloudTrail data events. Because legitimate administrative or analytical tasks may occasionally involve scanning tables, this detection focuses on identifying "new" or anomalous behavior by specific users or roles compared to their historical activity within the environment. Detecting this at scale requires that CloudTrail data events be explicitly enabled for the target DynamoDB tables.

Impact

Successful exploitation allows an adversary to gain unauthorized access to sensitive application data stored in DynamoDB. Depending on the scale of the tables targeted and the volume of data extracted, this can lead to significant data breaches, violation of privacy regulations, and potential loss of intellectual property. Organizations relying on DynamoDB for high-value user or business data are at highest risk if IAM credentials are misappropriated.

Recommendation

1. Enable AWS CloudTrail data events for all sensitive DynamoDB tables to ensure that the Scan operation is captured in logs.
2. Implement monitoring based on the described "New Terms" logic to alert on users performing Scan operations they have not historically executed.
3. Review IAM policies for the identified actors to verify that the dynamodb:Scan permission is strictly limited to authorized identities and functional service roles.
4. Investigate alerts by correlating the user.name and aws.cloudtrail.user_identity.arn with the source.ip and aws.cloudtrail.request_parameters to differentiate between malicious data scraping and authorized analytical processes.