cyber.hendryadrian.com
Threat Research · wiz.io

AWS Console Sessions Can Obscure the Identity Behind CloudTrail Activity

· Original article ↗

Summary

Wiz describes how attackers with stolen AWS credentials can use assumed roles and console sessions to complicate CloudTrail identity tracing, and explains how SourceIdentity or matching log fields can restore traceability.

Key points

  • The technique requires unauthorized access to credentials for an IAM user permitted to assume roles.
  • Attackers can set a misleading role session name, which appears in CloudTrail but is not verified identity metadata.
  • For AWS Console actions under an assumed role, the logged temporary access key differs from the key in the corresponding AssumeRole event, removing a simple correlation clue.
  • Requiring SourceIdentity in role trust policies can preserve an immutable originating identity in CloudTrail records.
  • Without SourceIdentity, investigators can correlate console activity with an AssumeRole event using principalId, userName, and sessionContext creationDate.
  • The article notes that matching by source IP can be unreliable because many console events may use internal AWS IP addresses.

Article Details

Attack Vectors
  • An attacker with unauthorized access to an IAM user's permanent AWS access key uses its permissions to assume an IAM role.
  • The attacker supplies a misleading role session name when assuming the role, then creates a federated console session and performs actions through the AWS Console. Due to the described Console Conceal behavior, those actions are logged with an access key ID that differs from the one in the corresponding AssumeRole event.
Defensive Notes
  • Require SourceIdentity in role trust policies and, for IAM users assuming roles, consider requiring the source identity to be the user's IAM username.
  • When SourceIdentity is unavailable, correlate console activity with prior AssumeRole events using principalId and roleSessionName, userName and roleName, and sessionContext_attributes_creationDate and eventTime; the AssumeRole eventTime may be up to one second earlier.
  • Correlating AssumeRole events with consoleLogin events can provide an external source IP address to help identify attackers.
  • Do not rely solely on source IP correlation for console events, since many may have internal AWS IP addresses.

MITRE ATT&CK

T1078.004 · Cloud AccountsThe described attacker uses stolen credentials for an IAM user to access AWS and perform actions.T1098.003 · Additional Cloud RolesThe attacker assumes the DevelopersRole using the compromised IAM user's permissions.T1136.003 · Cloud AccountThe fictional attack narrative describes creating a federated console session after assuming the role.

Vendors

Wizwiz academy13 Essential AWS IAM Best Practices

Products

AWSthey need, relying on understanding the original “whodunnit.” However, when investigating an alert in AWS using CloudTrail, the process of identifying the source entity behind an alert can become difficult due toAWS Management Consoleback to the original IAM principal. Surprisingly, this does not extend to actions performed through AWS Console.CloudTrailrelying on understanding the original “whodunnit.” However, when investigating an alert in AWS using CloudTrail, the process of identifying the source entity behind an alert can become difficult due to theSourceIdentityOur experience has also shown us that many customers haven’t implemented enhanced session traceability features provided by AWS, such as SourceIdentity, which can remove this complexity.

Related Articles