Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets

Attackers abused IAM roles that customers had previously granted to Qubole, a third-party data platform, to access AWS accounts without exploiting any software vulnerability — the permissions themselves were the attack surface. Because the trusted roles remained active even after Qubole integrations were no longer in use, adversaries had a persistent, legitimate-looking foothold to exfiltrate secrets and entire S3 buckets over nearly two weeks. This incident illustrates how third-party integrations silently accumulate excessive, long-lived cloud permissions that organizations rarely audit or revoke. The blast radius was amplified by the fact that IAM credentials associated with a vendor's AWS account — not the customer's own — were the initial vector, meaning customers had no visibility into the upstream compromise. Organizations must treat vendor-granted IAM trust relationships with the same rigor as direct employee access, enforcing least privilege and continuous lifecycle management.