Abuse of AWS IAM Roles Anywhere via External Trust Anchors

AWS IAM Roles Anywhere enables workloads outside of AWS to assume IAM roles by presenting X.509 certificates validated against a registered Trust Anchor. While designed to simplify hybrid cloud identity, it introduces a persistence vector if misconfigured. Attackers with sufficient permissions can register a rogue external Certificate Authority (CA) as a Trust Anchor by configuring sourceType as CERTIFICATE_BUNDLE or SELF_SIGNED_REPOSITORY instead of the AWS-managed AWS_ACM_PCA. Once established, the adversary can generate arbitrary client certificates signed by this rogue CA. These certificates allow the attacker to programmatically authenticate as sensitive IAM roles from any location, effectively bypassing AWS-native certificate lifecycle management and maintaining long-term access that survives credential rotation and standard revocation processes.

Impact

Successful exploitation allows for long-term, stealthy persistence within an AWS account. Attackers can assume highly privileged roles to exfiltrate data, modify cloud infrastructure, or escalate privileges further. Because the authentication is tied to a rogue CA controlled by the adversary, standard AWS-based revocation of temporary credentials or rotating service account keys will not invalidate the underlying access path until the Trust Anchor itself is deleted.

Recommendation

• Deploy the provided Sigma rule to detect the creation of any IAM Roles Anywhere Trust Anchor that does not utilize the AWS ACM Private CA.
• Restrict the rolesanywhere:CreateTrustAnchor IAM permission to a strictly limited set of security administrators.
• Audit existing Trust Anchors to ensure all registered CAs belong to approved, organizationally managed PKI infrastructure.
• Utilize AWS Config or Security Hub to monitor and alert on new Trust Anchor creations and changes in their configuration.