/
← Voltar ao feed
low

TrustedSec Red Team Guidance: Enumerating and Abusing Exposed AWS AKIA/ASIA Access Keys, and the CloudTrail Detection Points

1 fonte(s) · 1 atualização(ões) · publicado 10/09/2026 01:00 · coletado há 4 dias

TrustedSec published Part 1 of a red-team tradecraft series on what to do after finding plaintext AWS access keys during an engagement. It is educational content, not a report of a specific incident. It explains the difference between long-term AKIA keys (IAM user) and temporary ASIA keys (STS-issued, which also need a session token and are valid for 1 to 12 hours). It covers common credential locations, identity validation, unauthenticated reconnaissance using only the account ID, and a prioritized list of low-noise AWS API enumeration calls. Defenders can use it to understand how leaked keys are triaged and which CloudTrail artifacts to alert on.

Detalhes técnicos

  • Credential locations: ~/.aws/credentials, ~/.aws/config, ~/.aws/sso/, ~/.aws/cli/, environment variables, ~/.bash_history, and CI/CD logs. The ~/.aws/ directory is not encrypted by default.
  • Metadata endpoints: 169.254.169.254 (EC2 IMDS, IMDSv2 may require a token), 169.254.170.2/v4/credentials (container credentials, no token needed, so SSRF-friendly), and 169.254.170.23/v1/credentials (EKS IRSA or Pod Identity).
  • Identity validation: sts:GetCallerIdentity always works and cannot be denied by IAM policy, but it is logged in CloudTrail. An alternative is to trigger an AccessDenied error, which leaks the caller ARN. Invalid keys return SignatureDoesNotMatch.
  • Stealth via VPC Endpoints: using endpoints from an attacker-controlled account still leaves CloudTrail events. The detection flags are a vpcEndpointId that does not exist in the target account and an RFC1918 sourceIPAddress. AWS does not log the source account or organization ID.
  • Account-ID-only recon: search for public EBS snapshots, AMIs, RDS snapshots and ECR Public repositories owned by the target account. Use GrayhatWarfare, Awseye, crt.sh, Shodan and Censys. Search Sourcegraph, GitHub, GitLab and Bitbucket for the account ID in Terraform, CloudFormation and CI/CD files.
  • Enumeration priority: based on Sourcegraph counts of Terraform and CloudFormation usage in public repos. Calls include iam get-account-authorization-details, ec2 describe-instances, ec2 describe-security-groups, lambda list-functions, ssm describe-parameters, secretsmanager list-secrets, rds describe-db-instances, ecr describe-repositories and cloudtrail describe-trails. Each is a management event in CloudTrail. The author notes iam get-account-authorization-details is highly revealing and worth a dedicated detection.

Remediação

  • Alert on GetCallerIdentity and bulk IAM enumeration calls such as GetAccountAuthorizationDetails.
  • Validate vpcEndpointId values against known VPC endpoints in the account, and flag unexpected RFC1918 source IPs.
  • Enforce IMDSv2 and avoid storing long-lived keys in files, shell history or CI/CD logs.
  • Run secret scanning on repositories and logs, and prefer short-lived credentials.
  • Audit public EBS/RDS snapshots, AMIs and ECR repositories.

Linha do tempo

  1. trustedsec.com ↗ · pub. 10/09/2026 01:00 · coletado 19/10 17:57 primeiro registro

    TrustedSec Red Team Guidance: Enumerating and Abusing Exposed AWS AKIA/ASIA Access Keys, and the CloudTrail Detection Points

    ler a análise desta fonte

    TrustedSec published Part 1 of a red-team tradecraft series on what to do after finding plaintext AWS access keys during an engagement. It is educational content, not a report of a specific incident. It explains the difference between long-term AKIA keys (IAM user) and temporary ASIA keys (STS-issued, which also need a session token and are valid for 1 to 12 hours). It covers common credential locations, identity validation, unauthenticated reconnaissance using only the account ID, and a prioritized list of low-noise AWS API enumeration calls. Defenders can use it to understand how leaked keys are triaged and which CloudTrail artifacts to alert on.

    Technical Details

    • Credential locations: ~/.aws/credentials, ~/.aws/config, ~/.aws/sso/, ~/.aws/cli/, environment variables, ~/.bash_history, and CI/CD logs. The ~/.aws/ directory is not encrypted by default.
    • Metadata endpoints: 169.254.169.254 (EC2 IMDS, IMDSv2 may require a token), 169.254.170.2/v4/credentials (container credentials, no token needed, so SSRF-friendly), and 169.254.170.23/v1/credentials (EKS IRSA or Pod Identity).
    • Identity validation: sts:GetCallerIdentity always works and cannot be denied by IAM policy, but it is logged in CloudTrail. An alternative is to trigger an AccessDenied error, which leaks the caller ARN. Invalid keys return SignatureDoesNotMatch.
    • Stealth via VPC Endpoints: using endpoints from an attacker-controlled account still leaves CloudTrail events. The detection flags are a vpcEndpointId that does not exist in the target account and an RFC1918 sourceIPAddress. AWS does not log the source account or organization ID.
    • Account-ID-only recon: search for public EBS snapshots, AMIs, RDS snapshots and ECR Public repositories owned by the target account. Use GrayhatWarfare, Awseye, crt.sh, Shodan and Censys. Search Sourcegraph, GitHub, GitLab and Bitbucket for the account ID in Terraform, CloudFormation and CI/CD files.
    • Enumeration priority: based on Sourcegraph counts of Terraform and CloudFormation usage in public repos. Calls include iam get-account-authorization-details, ec2 describe-instances, ec2 describe-security-groups, lambda list-functions, ssm describe-parameters, secretsmanager list-secrets, rds describe-db-instances, ecr describe-repositories and cloudtrail describe-trails. Each is a management event in CloudTrail. The author notes iam get-account-authorization-details is highly revealing and worth a dedicated detection.

    Remediation

    • Alert on GetCallerIdentity and bulk IAM enumeration calls such as GetAccountAuthorizationDetails.
    • Validate vpcEndpointId values against known VPC endpoints in the account, and flag unexpected RFC1918 source IPs.
    • Enforce IMDSv2 and avoid storing long-lived keys in files, shell history or CI/CD logs.
    • Run secret scanning on repositories and logs, and prefer short-lived credentials.
    • Audit public EBS/RDS snapshots, AMIs and ECR repositories.