[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ft3LX6d8PZk4KbDdJP7v4J9Xd-ADcZBRJSRzHRRqEgbU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"2b92ee00-f321-4c64-82af-24209f2f8bb6","qubole-iam-credential-abuse-exposes-customer-aws-environments-via-cross-account-trust","f5146fef-336c-4f4b-8bdd-c2615591995f","Qubole IAM Credential Abuse Exposes Customer AWS Environments via Cross-Account Trust","A threat actor compromised IAM credentials within Qubole's AWS account and exploited pre-existing cross-account integration roles to gain unauthorized access to multiple customer AWS environments. This is a textbook supply chain attack: customers implicitly trusted Qubole's account, and that trust was weaponized to enumerate resources, exfiltrate S3 data, and harvest further credentials. The core failure was an overly permissive, insufficiently monitored trust relationship between Qubole and its customers. It matters because a single vendor compromise cascaded into breaches across many organizations that had no direct vulnerability of their own.","**Immediate actions:**\n- Audit and revoke all active cross-account IAM roles granted to third-party vendors, re-issuing only those with least-privilege, time-bounded permissions.\n- Rotate all IAM credentials and S3 access keys that were accessible to or used by Qubole integration roles.\n\n**Long-term improvements:**\n- Enforce the principle of least privilege on all third-party cross-account roles, scoping permissions to only the specific resources and actions required.\n- Implement external ID conditions and strict trust policy constraints on all cross-account IAM roles to prevent confused deputy attacks.\n- Establish a formal vendor access review process, reviewing and re-certifying all third-party IAM integrations on a quarterly basis.\n\n**Detection measures:**\n- Deploy continuous monitoring and anomaly detection on CloudTrail logs to alert on unusual cross-account AssumeRole activity, especially from vendor accounts.\n- Configure AWS GuardDuty and SIEM rules to flag credential harvesting behaviors such as bulk S3 ListBucket, GetObject, or IAM enumeration calls originating from third-party roles.",[12,13,14,15,16,17,18],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 5: Account Management","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 18: Penetration Testing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"CIS Control 5: Account Management":21,"CIS Control 18: Penetration Testing":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"CIS Control 17: Incident Response Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 Article 21(2)(b) requires supply chain security measures including controls over third-party service provider access; the absence of such controls allowed a vendor-side compromise to directly propagate into customer environments.","CIS Control 5 mandates managing the lifecycle of all accounts including service and third-party integration accounts; enforcing least-privilege and reviewing cross-account roles would have prevented the attacker from assuming overly permissive customer roles.","Regular penetration testing of the cloud environment and third-party integration points would have identified the exploitable cross-account role trust relationships before a real attacker did.","While this is a configuration and trust abuse issue rather than a software flaw, SI-2's principle of promptly identifying and correcting weaknesses applies directly to remediating misconfigured or over-permissive IAM trust relationships before they are exploited.","The attack spanned 12 days before detection by a third party (Sentra\u002FWiz), highlighting that neither Qubole nor its customers had effective incident response procedures to detect and contain the cross-account abuse in a timely manner.","Overly broad cross-account IAM permissions represent a known configuration vulnerability; ISO 27001 A.8.8 requires organizations to identify and remediate such vulnerabilities, which a periodic cloud posture review would have surfaced.","This incident stemmed from unconstrained cross-account IAM trust; PR.AA requires that access permissions be managed, enforced, and reviewed to ensure only authorized identities can access resources — a control that would have limited the blast radius of the vendor compromise.","published","2026-11-09T16:21:48.817431+00:00","2026-11-09T16:21:48.8+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Fqubole-cross-account-access-abused-in-the-wild","trusted-by-default-qubole-cross-account-access-abused-in-the-wild-ee49f6","Trusted by Default: Qubole Cross-Account Access Abused in the Wild",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":54,"name":55,"problem":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":58,"name":59,"problem":60},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak."]