AWS_CREATE_ACCESS_KEY

Summary

Forestall ACL Alias	AWS_CREATE_ACCESS_KEY
Edge Type	Attack Path
Affected Object Types	IAM Users
Exploitation Certainty	Certain
AWS IAM Action / Condition	iam:CreateAccessKey for target IAM user

Description

AWS_CREATE_ACCESS_KEY is the ability to create long-term API credentials for an IAM user.

An attacker with this permission generates a new key pair for a privileged user and authenticates as that user via the AWS CLI or SDK. Credentials persist until someone revokes them. If key governance is weak, they can sit undetected for months.

When the target already has two keys (the IAM limit), this path chains with AWS_DELETE_ACCESS_KEY.

Identification

AWS CLI

Check permission simulation.

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:CreateAccessKey \
  --resource-arns arn:aws:iam::123456789012:user/TargetUser

Review current keys on the target user.

aws iam list-access-keys --user-name TargetUser

AWS Console

• Open IAM -> Users -> select the target user.

• Open Security credentials tab.

• Under Access keys, verify whether the user already has 0, 1, or 2 active keys.

• To find who can create access keys for this user, check the Permissions tab of potential source users/roles for the iam:CreateAccessKey permission.

Exploitation

Create a key for the target user.

aws iam create-access-key --user-name TargetUser

Use the returned AccessKeyId and SecretAccessKey with the AWS CLI or SDK to act as that user.

Mitigation

• Restrict iam:CreateAccessKey to dedicated break-glass workflows.

• Prefer temporary STS credentials over long-term user keys.

• Rotate keys regularly and revoke unused ones immediately.

• Apply SCP and IAM guardrails to block user key creation where not required.

Detection

Monitor CloudTrail for access key creation.

• Event source: iam.amazonaws.com

• Event name: CreateAccessKey

Example lookup.

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateAccessKey

Prioritize events where the caller is creating a key for a different user.

References

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccessKeys.html

• https://docs.aws.amazon.com/general/latest/gr/iam-service.html

• https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html