Detection of Anomalous AWS IAM Long-Term Access Key Usage

This detection focuses on identifying the first use of long-term AWS IAM access keys (prefixed with AKIA) from an unfamiliar source IP address, as recorded in AWS CloudTrail logs. Long-term access keys do not expire automatically and are frequently targeted by attackers following credential leakage or supply-chain compromises. By establishing a behavioral baseline of which IP addresses successfully authenticate with specific access keys over a six-month window, security operations teams can identify potentially compromised credentials being used by threat actors to maintain programmatic access to cloud environments. This detection specifically excludes temporary security credentials (ASIA prefix) to minimize noise and focus on persistent, high-value identity assets.

Impact

Successful abuse of stolen long-term IAM keys allows adversaries to maintain persistent, programmatic access to sensitive cloud resources, including S3 buckets, secrets management services, and role-assumption APIs. Failure to detect such unauthorized usage can lead to significant data exfiltration, lateral movement within the cloud environment, or the deployment of additional malicious infrastructure.

Recommendation

• Deploy the detection logic to monitor logs-aws.cloudtrail-* for successful API calls where aws.cloudtrail.user_identity.access_key_id starts with AKIA and the source.ip is new relative to a 6-month baseline.
• Enable MFA for all console-accessible IAM users and mandate the use of temporary, role-based credentials (STS) for programmatic workloads to minimize the reliance on long-term keys.
• Utilize the investigation fields identified in the rule - specifically source.geo, user_agent.original, and aws.cloudtrail.user_identity.arn - to triage alerts by comparing them against known corporate egress IPs and build environment segments.
• Deactivate and rotate any keys identified as used from unauthorized or suspicious locations immediately.