Compromised Third-Party AWS Credentials Enable Multi-Tenant Cloud Breach
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers compromised IAM users within Qubole, a cloud data platform, and leveraged trusted role-assumption relationships to pivot into dozens of customer AWS accounts — a classic supply chain trust abuse. The root failure was the existence of overly permissive cross-account IAM roles that allowed a compromised vendor identity to reach customer environments without additional verification. Tools like TruffleHog were used to harvest embedded secrets from accessible resources, amplifying the damage once initial access was gained. This incident illustrates how third-party cloud integrations can silently expand your attack surface, turning a vendor's breach into your own data exfiltration event.
Tactical Insight
Immediate actions
- Audit and revoke all cross-account IAM roles granted to third-party vendors, re-issuing only the minimum permissions required.
- Rotate all AWS IAM credentials and secrets for accounts that had any trust relationship with Qubole.
- Enable AWS CloudTrail and GuardDuty across all accounts to detect anomalous role assumption and S3 data access.
Long-term improvements
- Apply least-privilege principles to all cross-account IAM roles and enforce permission boundaries to limit blast radius.
- Establish a formal third-party cloud access review process, including periodic re-certification of all vendor-assumed roles.
- Use AWS Service Control Policies (SCPs) to restrict which external principals can assume roles within your organization.
Detection measures
- Alert on unusual `sts:AssumeRole` activity originating from third-party account IDs, especially outside business hours.
- Monitor S3 bucket access logs for large-volume or bulk `GetObject` operations and trigger automated incident workflows on anomalies.
- Deploy secrets-scanning pipelines (similar to TruffleHog) internally to identify and remediate exposed credentials before attackers find them.