You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[Rule Tunings] AWS IAM Roles Anywhere Rules (#5307)
Both these rules are have low volume in telemetry as expected, this is quite rare behavior. No major changes to the rule logic itself.
AWS IAM Roles Anywhere Profile Creation
- updated description and investigation guide
- reduced execution window
- added highlighted fields
AWS IAM Roles Anywhere Trust Anchor Created with External CA
- changed rule type to EQL to use `stringContains` instead of leading wildcard
- uses `event.type` as event category override field
- reduced execution window
- updated description and investigation guide
- added highlighted fields
Identifies the creation of an AWS Roles Anywhere profile. AWS Roles Anywhere is a feature that allows you to use AWS
11
-
Identity and Access Management (IAM) profiles to manage access to your AWS resources from any location via trusted
12
-
anchors. This rule detects the creation of a profile that can be assumed from any service. Adversaries may create
13
-
profiles tied to overly permissive roles to maintain access to AWS resources. Ensure that the profile creation is
14
-
expected and that the trust policy is configured securely.
10
+
Detects the creation of a new AWS IAM Roles Anywhere profile. Roles Anywhere allows workloads or external systems to
11
+
assume IAM roles from outside AWS by authenticating via trusted certificate authorities (trust anchors). Adversaries who
12
+
have established persistence through a rogue trust anchor may create or modify profiles to link them with highly
13
+
privileged roles, enabling long-term external access to the AWS environment. This rule identifies successful
14
+
"CreateProfile" API calls and helps detect potentially unauthorized or risky external access configurations.
15
15
"""
16
16
false_positives = [
17
17
"""
18
18
AWS Roles Anywhere profiles are legitimate profiles that can be created by administrators to allow access from any
19
19
location. Ensure that the profile created is expected and that the trust policy is configured securely.
20
20
""",
21
21
]
22
-
from = "now-30m"
22
+
from = "now-6m"
23
23
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
24
-
interval = "10m"
25
24
language = "kuery"
26
25
license = "Elastic License v2"
27
26
name = "AWS IAM Roles Anywhere Profile Creation"
28
-
note = """
29
-
## Triage and analysis
27
+
note = """## Triage and analysis
30
28
31
-
### Investigating AWS IAM Roles Anywhere Profile Creation
32
-
33
-
This rule detects the creation of an AWS Roles Anywhere profile. AWS Roles Anywhere allows you to use AWS Identity and Access Management (IAM) profiles to manage access to your AWS resources from any location via trusted anchors. Adversaries may create profiles tied to overly permissive roles to maintain access to AWS resources. It is crucial to ensure that the profile creation is expected and that the trust policy is configured securely.
34
-
35
-
#### Possible Investigation Steps:
36
-
37
-
- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` fields to identify who created the profile. Verify if this actor typically performs such actions and if they have the necessary permissions.
38
-
- **Review the Request Details**: Examine the `aws.cloudtrail.request_parameters` to understand the specific details of the profile creation. Look for any unusual parameters or overly permissive roles that could suggest unauthorized or malicious activity.
39
-
- **Analyze the Source of the Request**: Investigate the `source.ip` and `source.geo` fields to determine the location and origin of the request. Ensure the request originated from a known and trusted location.
40
-
- **Check the Created Profile’s Permissions**: Review the `roleArns` associated with the created profile. Verify that the roles are appropriate for the user's intended actions and do not grant excessive permissions.
41
-
- **Verify the Profile’s Configuration**: Ensure that the profile's `durationSeconds`, `enabled`, and `tags` are configured according to your organization's security policies. Pay particular attention to any configuration that might allow prolonged access or concealment of activity.
42
-
43
-
### False Positive Analysis:
44
-
45
-
- **Legitimate Administrative Actions**: Confirm if the profile creation aligns with scheduled updates, development activities, or legitimate administrative tasks documented in change management systems.
46
-
- **Consistency Check**: Compare the action against historical data of similar actions performed by the user or within the organization. If the action is consistent with past legitimate activities, it might indicate a false alarm.
47
-
- **Verify through Outcomes**: Check the `aws.cloudtrail.response_elements` and the `event.outcome` to confirm if the profile creation was successful and intended according to policy.
29
+
> **Disclaimer**:
30
+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance.
31
+
> While every effort has been made to ensure its quality, validate and adapt it to suit your operational needs.
48
32
49
-
### Response and Remediation:
50
-
51
-
- **Immediate Review and Reversal if Necessary**: If the profile creation was unauthorized, disable or delete the created profile and review the associated roles and permissions for any potential misuse.
52
-
- **Enhance Monitoring and Alerts**: Adjust monitoring systems to alert on similar actions, especially those involving sensitive roles or unexpected locations.
53
-
- **Educate and Train**: Provide additional training to users with administrative rights on the importance of security best practices concerning profile and role management and the risks of unauthorized profile creation.
54
-
- **Audit IAM Policies and Permissions**: Conduct a comprehensive audit of all IAM policies and associated permissions to ensure they adhere to the principle of least privilege.
55
-
- **Incident Response**: If there's an indication of malicious intent or a security breach, initiate the incident response protocol to mitigate any damage and prevent future occurrences.
56
-
57
-
### Additional Information:
58
-
59
-
For further guidance on managing AWS IAM Roles Anywhere profiles and securing AWS environments, refer to the [AWS Roles Anywhere documentation](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html) and AWS best practices for security. Additionally, consult the following resources for specific details on profile management and potential abuse:
60
-
- [AWS IAM Roles Anywhere Profile Creation API Reference](https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_CreateProfile.html)
61
-
- [Ermetic Blog - Managing Third Party Access](https://ermetic.com/blog/aws/keep-your-iam-users-close-keep-your-third-parties-even-closer-part-1/)
33
+
### Investigating AWS IAM Roles Anywhere Profile Creation
62
34
35
+
AWS IAM Roles Anywhere allows external workloads — such as CI/CD runners, on-premises systems, or third-party services —
36
+
to assume IAM roles securely by presenting a certificate from a trusted anchor. A profile defines the IAM roles that
37
+
can be assumed, the trust anchor they are associated with, and session duration limits.
38
+
39
+
This rule detects when a new Roles Anywhere profile is created using the `CreateProfile` API call. Unauthorized profile
40
+
creation can enable persistent external access if tied to over-privileged roles or to trust anchors associated with
41
+
unauthorized certificate authorities (CAs). Monitoring profile creation is crucial to ensuring that only approved roles
42
+
and anchors are in use.
43
+
44
+
#### Possible investigation steps
45
+
46
+
- **Identify the actor**
47
+
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine
48
+
which IAM user, role, or principal created the profile.
49
+
- Check whether this identity normally manages Roles Anywhere configurations.
50
+
51
+
- **Review profile configuration**
52
+
- Inspect `aws.cloudtrail.request_parameters` for key values such as:
53
+
- `profileName`
54
+
- `roleArns` – confirm that the listed IAM roles are expected and not overly permissive.
55
+
- `trustAnchorArn` – verify the trust anchor is valid and authorized.
56
+
- `durationSeconds` – check for unusually long session durations.
57
+
- Determine if multiple roles were attached, which may indicate excessive privilege aggregation.
58
+
59
+
- **Correlate related activity**
60
+
- Check for prior or concurrent events by the same actor, including:
61
+
- `CreateTrustAnchor` with external or unauthorized certificate authorities.
62
+
- `CreateRole`, `PutRolePolicy`, or `AttachRolePolicy` for privilege escalation paths.
63
+
- Review whether subsequent `AssumeRoleWithCertificate` events occurred, indicating use of the new profile.
64
+
65
+
- **Assess the source context**
66
+
- Investigate `source.ip`, `user_agent.original`, and `source.geo` fields to identify if this request originated from an unfamiliar host, region, or automation client (e.g., `boto3`, `curl`, custom SDKs).
67
+
- Compare to baseline patterns of legitimate IAM or infrastructure automation.
68
+
69
+
- **Validate legitimacy**
70
+
- Contact the responsible team (e.g., platform, PKI, or IAM administration) to confirm whether this profile creation
71
+
aligns with approved change management or onboarding activities.
72
+
73
+
74
+
### False positive analysis:
75
+
76
+
- **Legitimate administrative actions**
77
+
- IAM or PKI engineers may legitimately create profiles during setup of new external integrations or workloads.
78
+
Validate against change control records and deployment logs.
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
0 commit comments