Qubole's Trusted AWS Credentials Weaponized to Breach Customer Accounts
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers exploited the inherent trust relationship between Qubole's data platform and its customers' AWS environments, using Qubole's own credentials to pivot laterally into multiple customer accounts and steal sensitive data. This is a classic supply chain attack: the vendor became the attack vector, bypassing any security controls the customers had in place individually. The fact that Qubole's credentials provided broad enough access to steal secrets and data suggests insufficient application of least-privilege principles in the cross-account trust model. Organizations that grant third-party vendors standing access to cloud environments face compounded risk when that vendor is compromised. This incident underscores why third-party access must be tightly scoped, continuously monitored, and subject to rigorous credential hygiene.
Tactical Insight
Immediate actions
- Rotate all AWS cross-account credentials shared with third-party vendors and enforce short-lived, role-based tokens (e.g., AWS STS AssumeRole) instead of long-lived keys.
- Audit all existing third-party IAM roles and permissions to verify they follow least-privilege principles and revoke any unnecessary access immediately.
Long-term improvements
- Implement a formal Third-Party Risk Management (TPRM) program that requires vendors to demonstrate credential hygiene, MFA enforcement, and periodic security assessments before granting cloud access.
- Enforce time-bound, just-in-time (JIT) access for all third-party integrations so vendor credentials cannot be used outside approved maintenance windows.
- Require contractual obligations for vendors to disclose credential compromise events within a defined SLA (e.g., 24 hours).
Detection measures
- Enable AWS CloudTrail and GuardDuty across all accounts to alert on anomalous cross-account API calls originating from vendor-associated roles.
- Set up automated alerts for bulk data reads or secrets access (e.g., AWS Secrets Manager, SSM Parameter Store) from third-party IAM roles to detect exfiltration early.