AssumeRole in CloudTrail: Following Role Sessions Across Accounts

What it records

AssumeRole asks AWS STS for temporary credentials for an IAM role: an access key ID, a secret access key and a session token. The record shows who asked (userIdentity), which role (requestParameters.roleArn), the session name and optional settings such as durationSeconds, an MFA serialNumber, sourceIdentity and session tags, and what came back: responseElements.assumedRoleUser and responseElements.credentials with the temporary key ID, its expiration and the session token. The secret access key is not in the record, in AWS’s examples or in the recorded attack-simulation event.

AWS’s example records mark AssumeRole as a management event with readOnly true. A role assumed across accounts is recorded in both accounts and the copies share a sharedEventID; in the role owner’s copy, AWS’s example shows the caller only as AWSAccount and an account ID. Requests to the global endpoint sts.amazonaws.com are logged in us-east-1, with additionalEventData.RequestDetails giving endpointType and awsServingRegion.

When it matters

Many AWS intrusions pass through AssumeRole. A stolen access key is used to step into a more privileged role or into another account, and from then on the attacker appears as the role session, not as the user who was compromised (MITRE ATT&CK T1078.004). The records worth stopping on:

• A role in an account you do not recognise, or a caller account you do not recognise in the role owner’s copy.
• Role chaining (userIdentity.type AssumedRole) from a session that does not normally hop between roles, especially towards administrative roles.
• Runs of AccessDenied. One principal failing to assume many roles is enumeration: tools try role names until one trusts them. The recorded denied attempt names the role only in errorMessage.
• A trust policy change first. An UpdateAssumeRolePolicy on the role shortly before the first assumption from a new account is a backdoor being used.

How to investigate

1. Establish the caller: userIdentity.arn and type, sourceIPAddress and userAgent. For a chained session, follow userIdentity.sessionContext.sessionIssuer.arn back to the role it came from and repeat.
2. Take responseElements.credentials.accessKeyId and list every later event whose userIdentity.accessKeyId matches. That is what the session did.
3. For a cross-account call, find the other account’s copy by sharedEventID.
4. Check the role’s history for UpdateAssumeRolePolicy and permission changes, and confirm that the session name and duration fit how the role is normally used.

Role sessions from the last day in Microsoft Sentinel, joined to what each session did:

let Sessions = AWSCloudTrail
    | where TimeGenerated > ago(1d)
    | where EventName == "AssumeRole" and isempty(ErrorCode)
    | extend Request = parse_json(RequestParameters), Response = parse_json(ResponseElements)
    | project AssumedAt = TimeGenerated, Caller = UserIdentityArn, CallerType = UserIdentityType,
        RoleArn = tostring(Request.roleArn), SessionName = tostring(Request.roleSessionName),
        TempKey = tostring(Response.credentials.accessKeyId), SourceIpAddress;
Sessions
| join kind=leftouter (
    AWSCloudTrail
    | where TimeGenerated > ago(1d)
    | summarize Calls = count(), Actions = make_set(EventName, 30) by UserIdentityAccessKeyId
  ) on $left.TempKey == $right.UserIdentityAccessKeyId
| project AssumedAt, Caller, CallerType, RoleArn, SessionName, SourceIpAddress, Calls, Actions

Denied attempts, which name the role in the error message:

AWSCloudTrail
| where TimeGenerated > ago(1d)
| where EventName == "AssumeRole" and ErrorCode == "AccessDenied"
| extend Role = extract(@"on resource: (\S+)", 1, ErrorMessage)
| summarize Attempts = count(), Roles = make_set(Role, 50) by UserIdentityArn, SourceIpAddress
| where Attempts >= 5

In Athena, over a table on the trail’s S3 bucket (named cloudtrail_logs here):

SELECT eventtime, useridentity.arn AS caller,
       json_extract_scalar(requestparameters, '$.roleArn') AS role_arn,
       json_extract_scalar(requestparameters, '$.roleSessionName') AS session_name,
       json_extract_scalar(responseelements, '$.credentials.accessKeyId') AS temp_key,
       sourceipaddress
FROM cloudtrail_logs
WHERE eventname = 'AssumeRole' AND errorcode IS NULL
ORDER BY eventtime DESC
LIMIT 200;