Skip to content
BreachPathAttack Path LibraryStart
IntermediateData theft

AWS access key to data exfiltration

A leaked long-lived AWS access key is used to enumerate the account, escalate through permissive IAM, and read and exfiltrate data from cloud storage and databases.

Technologies
AWS
Entry points
Stolen credentials, Vulnerable application
Sectors
SaaS & technology, Retail, Financial services…
Stages
3
01

A leaked long-lived access key is used

A long-lived access key is exposed — committed to code, left on a host, or leaked through an application — and the attacker uses it to make authenticated API calls as that identity.

Attacker objective

Authenticate to the AWS account with a valid programmatic credential.

MITRE ATT&CK
Controls that should stop this
  • Eliminate long-lived keys in favour of short-lived, federated credentials
  • Secret scanning and automated key rotation
  • Restrict key use by network origin where feasible
What defenders should see
  • API calls from a new source IP or unusual region
  • First-seen API actions for the credential
  • Access-key use outside its normal service context
What a pentest validates
  • Scan code and infrastructure for exposed keys
  • Review whether long-lived keys can be replaced with short-lived credentials
  • Test detection of anomalous key use
Business impact

The attacker holds a valid cloud identity and can query what it is allowed to.

02

Permissions are enumerated and escalation is sought

The attacker enumerates the identity's permissions and the account's resources, looking for over-broad policies or escalation opportunities that widen what data and services they can reach.

Attacker objective

Understand the identity's rights and find a path to broader access.

MITRE ATT&CK
Controls that should stop this
  • Least-privilege IAM with no wildcard administrative policies
  • Guardrails / service control policies limiting escalation
  • Continuous IAM access review and unused-permission pruning
What defenders should see
  • Bursts of describe/list and IAM enumeration calls
  • Attempts to read or modify IAM policies
  • Access patterns inconsistent with the identity's normal role
What a pentest validates
  • Map privilege-escalation paths from the compromised identity
  • Review IAM policies for wildcard and escalation-prone permissions
  • Validate service control policies constrain the blast radius
Business impact

The attacker maps the reachable data and any route to more of it.

03

Data is read and exfiltrated

Using the permissions available, the attacker reads from object storage and databases and moves the data out to attacker-controlled infrastructure, pacing activity to blend with normal traffic.

Attacker objective

Access and remove the customer data that is the target.

MITRE ATT&CK
Controls that should stop this
  • Encryption with tightly controlled key access and bucket policies
  • Egress anomaly detection and blocking on data stores
  • Access logging with alerting on bulk reads
What defenders should see
  • Anomalous read/download volume from storage or databases
  • Data egress to unfamiliar destinations
  • Access to datasets the identity has never read before
What a pentest validates
  • Authorised, controlled test of reading and exfiltrating a sample dataset
  • Verify detection and blocking of bulk cloud-storage reads
  • Confirm object and database access logging is complete
Business impact

Customer data is exfiltrated — triggering breach notification and regulatory exposure.

ATT&CK techniques in this chain

T1078.004Valid Accounts: Cloud AccountsT1552.001Unsecured Credentials: Credentials In FilesT1567.002Exfiltration Over Web Service: Cloud StorageT1530Data from Cloud StorageT1580Cloud Infrastructure Discovery

If this chain completes

Exposure and exfiltration of customer data held in cloud storage and databases — a reportable breach driven by a single mismanaged credential and over-broad permissions.

Should you test this against your environment?

Turn this chain into a scoped red-team brief — objective, systems and identities in scope, testing assumptions and the questions to answer before commissioning.

Generate my red-team test briefExplore more paths