Privilege Escalation
iam:CreateAccessKey
An attacker with iam:CreateAccessKey mints long-term CLI credentials for a more privileged user.
Required Permissions
Description
iam:CreateAccessKey issues a new access-key pair for an IAM user. A user can hold up to two keys at once, so if a target already has two, the technique does not apply until one is deleted. Otherwise the call succeeds immediately and returns the key id and secret.
The hackaws agent ranks eligible users by effective permissions and targets the top candidates (users with fewer than two existing keys and who are not the caller). The resulting keys authenticate as the target user with the full set of policies that user holds.
Access keys do not expire. They survive password resets, role rotation, and session revocation. The only mitigation after issuance is to delete the key.
Impact
Long-term credentials for the target user. If the target has administrator access, the attacker now has administrator credentials outside the current session that persist until the key is deleted.
Detection
Alert on CreateAccessKey events where the UserName does not match the caller. Alert on events for users who have not rotated keys recently or who have no history of using key-based access. Review the access-key list for every user on a schedule.
Mitigation
Deny iam:CreateAccessKey from non-admin principals through an SCP. Enforce a Condition that pins iam:UserName to the caller so a user cannot mint keys for anyone else. Prefer SSO and short-term credentials over long-term access keys.