Detecting Unauthorized AWS IAM Access Key Creation

Unauthorized creation of AWS IAM access keys is a technique used by adversaries to establish persistence or facilitate privilege escalation within an AWS environment. By leveraging the 'CreateAccessKey' API call, an attacker who has compromised an IAM user with appropriate permissions can generate new, long-lived access credentials for other users within the same AWS account. This behavior is particularly dangerous when the target user maintains higher privileges than the caller. Monitoring for discrepancies between the IAM user performing the action and the IAM user for whom the key is being created is a critical control for identifying suspicious administrative activity and potential lateral movement or persistence attempts.

Impact

Successful exploitation of this technique can lead to full account compromise, unauthorized data exfiltration, and the creation of backdoors that allow attackers to maintain access even if their initial entry point is remediated. Organizations relying on AWS IAM are at risk if they do not maintain strict least-privilege policies for the 'iam:CreateAccessKey' permission.

Recommendation

• Implement monitoring for 'CreateAccessKey' events where the 'userIdentity.userName' does not match the 'requestParameters.userName' in AWS CloudTrail logs.
• Review and tighten IAM policies to ensure that only authorized administrators possess the 'iam:CreateAccessKey' permission.
• Audit existing IAM access keys regularly to identify and disable unused or suspicious keys.