Compromised Third-Party IAM Credentials Enable Cross-Account AWS Secret Theft
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers compromised IAM credentials belonging to Qubole, a trusted AWS integration partner, and leveraged cross-account trust relationships to pivot into multiple customer AWS environments. The root failure was twofold: Qubole's credentials were inadequately protected, and customer organizations never revoked deprecated trust policies after they were no longer needed. This matters because third-party integrations extend your attack surface beyond your own perimeter — an adversary who owns a trusted partner effectively owns a door into your environment. The theft of secrets from S3, Lambda, Secrets Manager, and SSM Parameter Store demonstrates how over-privileged, stale cross-account roles amplify the blast radius of a single supplier compromise.
Tactical Insight
Immediate actions
- Audit and revoke all deprecated or unused cross-account IAM trust policies in your AWS environment immediately.
- Rotate any IAM credentials, OAuth tokens, and secrets that may have been exposed through Qubole or similar third-party integrations.
- Enable AWS CloudTrail and Amazon GuardDuty to detect anomalous cross-account access patterns in real time.
Long-term improvements
- Enforce least-privilege IAM policies for all third-party integrations, granting only the minimum permissions required for each specific function.
- Implement a periodic (at minimum quarterly) review process to identify and remove stale cross-account trust relationships and unused IAM roles.
- Adopt a formal third-party risk management program that requires suppliers to demonstrate credential hygiene and undergo security assessments before integration.
Detection measures
- Deploy secrets scanning tooling (e.g., similar to TruffleHog used by attackers) proactively across your own repositories and configurations to find exposed credentials before adversaries do.
- Set up alerts for unusual API calls to Secrets Manager, SSM Parameter Store, and S3 from cross-account principals or unfamiliar IAM entities.
- Monitor Okta and Microsoft Entra ID logs for OAuth token issuance from unexpected sources or service accounts associated with third-party integrations.