Stale Third-Party IAM Roles Enable Qubole Supply Chain Data Theft
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers exploited compromised Qubole AWS IAM credentials to assume cross-account roles that victim organizations had configured for Qubole's use, gaining unauthorized access to their AWS environments. The core failure was that organizations never revoked or audited these IAM roles after discontinuing their use of Qubole, leaving persistent, privileged access pathways open for years. This is a textbook supply chain access control failure: trusting a third-party vendor with standing cloud permissions without enforcing a lifecycle process to remove that trust when the relationship ends. The incident highlights how third-party integrations create implicit, long-lived attack surfaces that are frequently forgotten. Attackers had a 12-day window to enumerate resources, harvest secrets, and exfiltrate data entirely because no one was watching these dormant roles.
Tactical Insight
Immediate actions
- Audit all existing cross-account IAM roles and immediately revoke any associated with vendors or services no longer in active use.
- Rotate or invalidate all IAM credentials shared with or used by Qubole and conduct a full review of CloudTrail logs for the affected period.
Long-term improvements
- Establish a formal third-party access lifecycle policy requiring IAM role revocation as part of vendor offboarding procedures.
- Apply least-privilege principles to all cross-account IAM roles, scoping permissions to only what is strictly necessary and time-bounding access where possible.
- Maintain a continuously updated inventory of all third-party integrations and their associated cloud permissions.
Detection measures
- Enable AWS CloudTrail and configure alerts for unexpected role assumption activity, especially from external AWS accounts.
- Implement periodic automated reviews (e.g., AWS IAM Access Analyzer) to surface unused or over-permissioned cross-account roles.