AWS_DELETE_ACCESS_KEY
Summary
Forestall ACL Alias
AWS_DELETE_ACCESS_KEY
Edge Type
Attack Path
Affected Object Types
IAM Users
Exploitation Certainty
Certain
AWS IAM Action / Condition
iam:DeleteAccessKey for target IAM user
Description
AWS_DELETE_ACCESS_KEY is the ability to delete an existing access key from an IAM user.
On its own, this can disrupt service. In an attack chain, it is used to:
Clear a key slot when the target user already has two keys.
Create attacker-controlled credentials via
AWS_CREATE_ACCESS_KEY.Replace legitimate credentials with attacker-managed ones for persistence.
Identification
AWS CLI
Check whether a principal can delete access keys for a target user:
List existing target keys:
AWS Console
Open IAM -> Users -> select target user.
Open Security credentials.
Review access keys and delegated permissions for key management.
Exploitation
Delete an existing key:
Common chain:
Delete key to free slot (
AWS_DELETE_ACCESS_KEY).Create attacker key (
AWS_CREATE_ACCESS_KEY).
Mitigation
Restrict
iam:DeleteAccessKeyto dedicated identity lifecycle processes.Separate key deletion and key creation duties where possible.
Alert when keys are deleted for high-value users outside approved windows.
Require change control for IAM credential management actions.
Detection
Monitor CloudTrail:
Event source:
iam.amazonaws.comEvent name:
DeleteAccessKey
Example lookup:
Correlate with CreateAccessKey activity on the same user within a short window.
References
Last updated
Was this helpful?