Stale Third-Party IAM Trust Relationships Exploited to Drain AWS S3 Buckets
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers abused IAM roles that customers had previously granted to Qubole, a third-party data platform, to access AWS accounts without exploiting any software vulnerability — the permissions themselves were the attack surface. Because the trusted roles remained active even after Qubole integrations were no longer in use, adversaries had a persistent, legitimate-looking foothold to exfiltrate secrets and entire S3 buckets over nearly two weeks. This incident illustrates how third-party integrations silently accumulate excessive, long-lived cloud permissions that organizations rarely audit or revoke. The blast radius was amplified by the fact that IAM credentials associated with a vendor's AWS account — not the customer's own — were the initial vector, meaning customers had no visibility into the upstream compromise. Organizations must treat vendor-granted IAM trust relationships with the same rigor as direct employee access, enforcing least privilege and continuous lifecycle management.
Tactical Insight
Immediate actions
- Audit all cross-account IAM roles and trust policies immediately, revoking any that reference inactive or unnecessary third-party integrations.
- Rotate or invalidate all IAM credentials associated with Qubole or similar vendor-linked roles, and review CloudTrail logs for the October 14–26 window for unauthorized API calls.
- Enable S3 Block Public Access and S3 Object Lock on sensitive buckets to limit the impact of compromised credentials.
Long-term improvements
- Enforce a formal third-party IAM access lifecycle process requiring periodic revalidation and automatic expiry of cross-account trust relationships.
- Apply least-privilege principles to all vendor IAM roles, scoping permissions to only the specific S3 paths and actions each integration requires.
- Maintain a continuously updated inventory of all external AWS account IDs granted trust in your environment and tie each entry to an active business justification.
Detection measures
- Configure AWS CloudTrail and GuardDuty alerts to trigger on unusual S3 bulk-download activity or cross-account role assumptions from unexpected source accounts.
- Implement anomaly detection on IAM role usage patterns so that activity from dormant roles raises an immediate alert.
- Set up AWS Config rules to flag any cross-account trust relationship that has not been used or reviewed within a defined threshold (e.g., 90 days).