aws:cloudtrail CreateAccessKey
CreateAccessKey
- Log source
- AWS CloudTrail
- Host type
- AWS
- Tier, host type
- Minimum
- Techniques
- 1
- Rules depending on it
- Splunk 1, Elastic 7, Microsoft Sentinel 3
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| AWS account | Minimum |
Techniques it helps detect
Rules that depend on it
Splunk 1
Elastic 7
- AWS IAM Credentials Added to a Bedrock API Key Phantom User
- AWS IAM Sensitive Operations via Lambda Execution Role
- AWS IAM User Created Access Keys For Another User
- AWS IAM User Self-Created Access Key Subsequently Used
- AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity
- AWS Rare Source AS Organization Activity
- AWS Sensitive IAM Operations Performed via CloudShell