AWS Details Attack Path From Stolen Cloud Credentials to Full Compromise
Amazon Web Services has outlined a common attack chain where compromised cloud credentials are used to achieve broad cloud compromise, detailing the phases from initial access to exfiltration.
Amazon Web Services (AWS) has provided a detailed analysis of how attackers can leverage stolen cloud credentials to execute comprehensive compromises within cloud environments. The common attack path begins with the acquisition of valid AWS keys or session tokens, granting attackers initial access as if they were legitimate users. From this foothold, adversaries can proceed through discovery, privilege escalation, lateral movement, and ultimately, data exfiltration or system manipulation.
AWS analysts have mapped this attack sequence into five distinct phases: initial access, discovery, privilege escalation, lateral movement, and exfiltration. The process often starts with attackers using stolen credentials to confirm their validity, frequently by making calls like GetCallerIdentity, GetSessionToken, or AssumeRole from unfamiliar IP addresses. This is typically followed by a series of List, Describe, and Get requests to enumerate cloud resources. Notably, repeated AccessDenied errors can serve as an indicator, as attackers may be testing account limits or permissions.
Privilege escalation is a critical step where attackers seek to gain greater control. This can involve identifying and exploiting misconfigured role chains or overly permissive IAM policies. AWS highlights specific API calls such as PutRolePolicy, CreateAccessKey, and AttachUserPolicy as potential signals for such activities. A concerning aspect is that attackers with sufficient privileges may attempt to tamper with CloudTrail logs, the very records defenders rely on to detect their actions.
Once elevated privileges are obtained, attackers can move laterally within the cloud environment. This phase often involves accessing sensitive data stores, such as S3 buckets, using legitimate roles to perform GetObject requests. The subsequent exfiltration stage typically involves transferring this data outside the compromised environment. AWS recommends correlating high read volumes from sensitive buckets with outbound network transfers and DNS requests to newly registered or suspicious domains, especially when the principal performing these actions should not have access to that data.
To detect these coordinated intrusions, AWS emphasizes the importance of correlating signals from various log sources, including CloudTrail, VPC Flow Logs, and Route 53 Resolver logs. While individual alerts might appear benign, linking them by event time and context can reveal a sophisticated, coordinated attack. For instance, a human identity performing unusual role assumptions at an odd hour, followed by the creation of new access keys, warrants immediate investigation.
AWS recommends enabling and tuning security services like GuardDuty, CloudTrail, VPC Flow Logs, and Route 53 Resolver query logging. While automated threat detection services can identify common patterns, they often lack the specific context of an organization's normal operations. Therefore, security teams must define what constitutes normal behavior, such as approved readers for specific storage buckets, legitimate role chains, and expected change windows.
For storage security, enabling CloudTrail data events is crucial, as management events alone do not capture object-level activity. Establishing baselines for object read activity and setting thresholds, such as the 95th percentile, can help identify anomalous access patterns. Correlating identity events with network records by event time, rather than query time, is also vital, accounting for potential CloudTrail delivery lags.
Ultimately, the core lesson from AWS is to treat cloud identity as the central thread connecting an attack. By tracking the same principal across different services, comparing actions against established business behavior, and responding to the sequence of events rather than isolated alerts, organizations can significantly reduce the effectiveness of stolen credentials and prevent quiet intrusions from escalating into full-scale breaches. Prompt containment, coupled with robust log correlation and an understanding of normal operational patterns, is key to defending against these evolving threats.