Found some Access Keys?
Last updated
Last updated
This post details on why its a bad idea to revoke access keys belonging to IAM User in case they have been leaked to an attacker and how red teams can use this less known technique to increase the blast radius and use access keys irrespective of it made being inactive.
Most of time you would have heard about getting STS Tokens belonging to a IAM Role but its quite possible to obtain STS Tokens belonging to IAM User and you dont need any permission attached to do so unlike sts:AssumeRole for Role.
Now, let's fetch those STS tokens for this key. Note that the key is still active.
The best part about above API Call is you can max out the duration of STS tokens and unlike Roles there is nothing a defender can do to avoid long durations of STS tokens :).
Now, the defender has been notified and has made the key inactive.
As evident get-caller-identity calls will be failing now.
Even though the key has been made inactive, attacker can use the obtained STS tokens and make API Calls.
As a red teamer, always do get-session-token to validate a key since in case of valid access keys it would give out STS tokens but in case of invalid access keys, it will error out. This way even if defender makes the key inactive, you still have the keys to kingdom :)
As a defender, make sure to attach policy to the access key to revoke all STS tokens rather than making the key inactive. Making Key INACTIVE DOESN'T REALLY HELP.
To the bot writers, automate in a way to make get-session-token with max duration rather then simply doing get-caller-identity and alerting security teams :)
