[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvT9Ya4x53vEN2gEO9JQE73XdH5ts3Ac1AKrGIw4UhXM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"bfaea9ab-71f6-46da-88c9-ebacedd669fb","stale-third-party-iam-trust-relationships-exploited-to-drain-aws-s3-buckets","5f511364-1ba2-4da5-9bda-6095130b55e8","Stale Third-Party IAM Trust Relationships Exploited to Drain AWS S3 Buckets","Attackers abused IAM roles that customers had previously granted to Qubole, a third-party data platform, to access AWS accounts without exploiting any software vulnerability — the permissions themselves were the attack surface. Because the trusted roles remained active even after Qubole integrations were no longer in use, adversaries had a persistent, legitimate-looking foothold to exfiltrate secrets and entire S3 buckets over nearly two weeks. This incident illustrates how third-party integrations silently accumulate excessive, long-lived cloud permissions that organizations rarely audit or revoke. The blast radius was amplified by the fact that IAM credentials associated with a vendor's AWS account — not the customer's own — were the initial vector, meaning customers had no visibility into the upstream compromise. Organizations must treat vendor-granted IAM trust relationships with the same rigor as direct employee access, enforcing least privilege and continuous lifecycle management.","**Immediate actions:**\n- Audit all cross-account IAM roles and trust policies immediately, revoking any that reference inactive or unnecessary third-party integrations.\n- Rotate or invalidate all IAM credentials associated with Qubole or similar vendor-linked roles, and review CloudTrail logs for the October 14–26 window for unauthorized API calls.\n- Enable S3 Block Public Access and S3 Object Lock on sensitive buckets to limit the impact of compromised credentials.\n\n**Long-term improvements:**\n- Enforce a formal third-party IAM access lifecycle process requiring periodic revalidation and automatic expiry of cross-account trust relationships.\n- Apply least-privilege principles to all vendor IAM roles, scoping permissions to only the specific S3 paths and actions each integration requires.\n- Maintain a continuously updated inventory of all external AWS account IDs granted trust in your environment and tie each entry to an active business justification.\n\n**Detection measures:**\n- Configure AWS CloudTrail and GuardDuty alerts to trigger on unusual S3 bulk-download activity or cross-account role assumptions from unexpected source accounts.\n- Implement anomaly detection on IAM role usage patterns so that activity from dormant roles raises an immediate alert.\n- Set up AWS Config rules to flag any cross-account trust relationship that has not been used or reviewed within a defined threshold (e.g., 90 days).",[12,13,14,15,16],"CIS Control 5: Account Management (v8)","CIS Control 6: Access Control Management (v8)","NIST SP 800-53 AC-2: Account Management","NIS2 Article 21(2)(d)","MITRE ATT&CK T1078: Valid Accounts",{"NIS2 Article 21(2)(d)":18,"MITRE ATT&CK T1078: Valid Accounts":19,"CIS Control 5: Account Management (v8)":20,"NIST SP 800-53 AC-2: Account Management":21,"CIS Control 6: Access Control Management (v8)":22},"NIS2 Article 21(2)(d) mandates supply chain security measures, requiring organizations to assess and manage the security risks introduced by third-party service providers such as Qubole.","The attackers used legitimate, pre-existing IAM credentials associated with the Qubole account to access customer environments, matching the Valid Accounts technique of abusing trusted credentials rather than exploiting a vulnerability.","CIS Control 5 requires inventorying and actively managing all accounts, including third-party and service accounts, which would have prompted timely revocation of the unused Qubole IAM trust relationships before they could be exploited.","AC-2 requires organizations to monitor, review, and disable accounts or access that are no longer needed, directly addressing the failure to revoke IAM trust relationships after Qubole integrations became inactive.","CIS Control 6 calls for enforcing least-privilege and regularly reviewing access rights, which would have limited the scope of permissions granted to the Qubole-associated IAM roles and reduced the data accessible during the breach.","published","2026-11-10T14:22:43.871301+00:00","2026-11-10T14:22:43.853+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fqubole-iam-roles\u002F","hackers-exploit-trusted-qubole-iam-roles-to-access-aws-accounts-and-download-ent-32f681","Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":50,"name":51,"problem":52},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":54,"name":55,"problem":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak."]