[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRSxgNUkXisnueRbVyB9t6YTycZZXeTDQCZIGOvnY8Z8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"740a3186-3dfb-4113-bdbb-91755f0bbc4a","stale-third-party-iam-roles-enable-qubole-supply-chain-data-theft","ae81e20c-02cc-45ae-8865-d13f36711d53","Stale Third-Party IAM Roles Enable Qubole Supply Chain Data Theft","Attackers exploited compromised Qubole AWS IAM credentials to assume cross-account roles that victim organizations had configured for Qubole's use, gaining unauthorized access to their AWS environments. The core failure was that organizations never revoked or audited these IAM roles after discontinuing their use of Qubole, leaving persistent, privileged access pathways open for years. This is a textbook supply chain access control failure: trusting a third-party vendor with standing cloud permissions without enforcing a lifecycle process to remove that trust when the relationship ends. The incident highlights how third-party integrations create implicit, long-lived attack surfaces that are frequently forgotten. Attackers had a 12-day window to enumerate resources, harvest secrets, and exfiltrate data entirely because no one was watching these dormant roles.","**Immediate actions:**\n- Audit all existing cross-account IAM roles and immediately revoke any associated with vendors or services no longer in active use.\n- Rotate or invalidate all IAM credentials shared with or used by Qubole and conduct a full review of CloudTrail logs for the affected period.\n\n**Long-term improvements:**\n- Establish a formal third-party access lifecycle policy requiring IAM role revocation as part of vendor offboarding procedures.\n- Apply least-privilege principles to all cross-account IAM roles, scoping permissions to only what is strictly necessary and time-bounding access where possible.\n- Maintain a continuously updated inventory of all third-party integrations and their associated cloud permissions.\n\n**Detection measures:**\n- Enable AWS CloudTrail and configure alerts for unexpected role assumption activity, especially from external AWS accounts.\n- Implement periodic automated reviews (e.g., AWS IAM Access Analyzer) to surface unused or over-permissioned cross-account roles.",[12,13,14,15,16],"CIS Control 5: Account Management (v8)","CIS Control 6: Access Control Management (v8)","NIST SP 800-53 AC-2: Account Management","NIS2 Article 21(2)(d)","NIST CSF 2.0 PR.AA-05: Access Permissions and Authorizations",{"NIS2 Article 21(2)(d)":18,"CIS Control 5: Account Management (v8)":19,"NIST SP 800-53 AC-2: Account Management":20,"CIS Control 6: Access Control Management (v8)":21,"NIST CSF 2.0 PR.AA-05: Access Permissions and Authorizations":22},"NIS2 Article 21(2)(d) explicitly requires security measures addressing supply chain risks, including the security of relationships with direct suppliers, which would have mandated controls over third-party cloud access and their revocation upon offboarding.","CIS Control 5 requires organizations to manage the lifecycle of all accounts, including disabling or removing credentials and access rights for third parties no longer in use, which would have prevented the stale Qubole IAM roles from remaining exploitable.","AC-2 requires organizations to review accounts for compliance with account management requirements and remove or disable accounts that are no longer needed, directly applicable to the unrevoked third-party IAM roles here.","CIS Control 6 calls for granting access based on least privilege and regularly reviewing access rights, which would have identified and removed the excessive, dormant cross-account IAM roles granted to Qubole.","This category requires that access permissions are managed, enforced, and reviewed, including removal of access that is no longer required, which would have caught the abandoned Qubole cross-account roles before attackers could exploit them.","published","2026-11-10T14:22:21.43858+00:00","2026-11-10T14:22:21.421+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fover-a-dozen-organizations-hit-in-qubole-supply-chain-attack\u002F","over-a-dozen-organizations-hit-in-qubole-supply-chain-attack-40742b","Over a Dozen Organizations Hit in Qubole Supply Chain Attack",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":50,"name":51,"problem":52},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":54,"name":55,"problem":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak."]