Wiki › Techniques, Tactics & Procedures (TTPs) › Lateral Movement › Cloud Lateral Movement via IAM Roles

Cloud Lateral Movement via IAM Roles

2 min read

Jump to:

Overview

Cloud lateral movement via IAM roles is a technique where adversaries leverage permissions and trust relationships between cloud identities to move within a cloud environment. This method is used to expand access beyond an initially compromised account, enabling attackers to reach additional resources and escalate privileges. It plays a critical role in the lateral movement phase of the attack lifecycle within cloud infrastructures.

Attack Objective

Expand access and control within a cloud environment
Lateral Movement stage of the attack lifecycle
Advances the attacker’s position by exploiting role trust and permission delegation to access additional cloud resources and services

How the Technique Works

Adversaries exploit the ability of cloud IAM roles to be assumed by other identities, often by abusing overly permissive trust policies or compromised credentials. By assuming or chaining IAM roles, attackers gain new permissions and access to resources that were not directly accessible from the initial foothold. This enables movement across accounts, services, or regions within the cloud provider’s environment without needing to compromise additional credentials directly.

Common Methods & Variations

Exploitation of cross-account or cross-service IAM role trust relationships
Use of cloud-native identity and access management features such as role assumption, delegation, or federation
Variations include on-premises to cloud lateral movement via federated identities, or cloud-to-cloud lateral movement across linked accounts
Predominantly living-off-the-land using native cloud APIs and tooling rather than custom malware

Indicators of Compromise (IOCs)

Unusual or unauthorized role assumption events in cloud audit logs
Access patterns inconsistent with normal user behavior, such as role chaining or cross-account access
Elevated API calls related to IAM role operations or token requests
Unexpected creation or modification of IAM policies and trust relationships

Detection Strategies

Monitoring cloud audit logs (e.g., AWS CloudTrail, Azure Activity Logs, GCP Cloud Audit Logs) for anomalous role assumption and permission usage
Behavioral detection focusing on deviations from established identity and access patterns
Correlation of identity activity with network and endpoint telemetry to identify suspicious lateral movement

Mitigation & Prevention

Implement least privilege principles for IAM roles and trust policies
Regularly audit and restrict cross-account and cross-service role assumptions
Enforce strong authentication and session management controls, including multi-factor authentication (MFA)
Use conditional access policies and monitor for anomalous identity behavior

Response Considerations

Immediately revoke or restrict compromised roles and credentials
Conduct thorough investigation of role assumption logs and access patterns to scope the extent of lateral movement
Review and harden IAM policies and trust relationships post-incident
Implement enhanced monitoring and alerting to detect future attempts

Related Techniques

Credential Access via Cloud Identity Compromise
Privilege Escalation through IAM Policy Abuse
Initial Access via Cloud Service Misconfiguration
Defense Evasion by abusing cloud-native identity features

Mapping & References

MITRE ATT&CK: T1078 (Valid Accounts), T1191 (Cloud Instance Metadata API), T1531 (Account Access Removal), T1569.002 (System Services: Service Execution)
Public advisories on cloud lateral movement and IAM abuse from cloud providers and cybersecurity organizations
Incident reports detailing real-world exploitation of IAM roles for lateral movement

Tags: Attack Lifecycle Cloud Security Cloud Threats Cybersecurity Techniques IAM Roles identity and access management Incident Response lateral movement privilege escalation Threat Detection