AWS credential theft can lead to full cloud takeovers

Published August 26, 2026

AWS published guidance on how attackers turn one stolen cloud login key into a full account takeover. A single leaked AWS key lets someone poke around, grab more permissions, and pull data out before anyone notices.

Report priority
High
Targets
CloudTrail+1 more

How it works

An attacker who obtains a valid AWS access key or session token uses it to call identity checks like GetCallerIdentity, then lists and reads resources, then looks for a role or policy they can change to grant themselves more access, and finally reads data from storage and sends it out to a new destination.

What to do

Review whether your AWS account has CloudTrail, VPC Flow Logs, and Route 53 Resolver query logging turned, and whether you would notice a login from an unfamiliar location followed by new access keys or policy changes.

Turn on CloudTrail (including data events for S3, not just management events), VPC Flow Logs, and Resolver logging, then set up an alert that correlates a login from a new location with privilege-granting calls like PutRolePolicy, CreateAccessKey, or AttachUserPolicy within the same short time window. Enable GuardDuty and require multi-factor authentication so a phished password alone cannot produce a usable session.

Technical details

Affected software: CloudTrail, GuardDuty

AWS describes a five-phase attack chain for compromised identities: initial access (a leaked key or phished session used from a new location), discovery (GetCallerIdentity, List/Describe/Get calls), privilege escalation (PutRolePolicy, CreateAccessKey, AttachUserPolicy), lateral movement (role assumption), and exfiltration (high-volume GetObject reads correlated with outbound network flows and new DNS lookups). AWS recommends baselining normal behavior, alerting on reads above the 95th percentile, and correlating CloudTrail, VPC Flow Logs, and Resolver logs within a roughly ten-minute window, accounting for CloudTrail's 5 to 15 minute delivery lag.

References

View Original Source