AWS_DELETE_ACCESS_KEY

Copy page

Summary


Forestall ACL Alias	AWS_DELETE_ACCESS_KEY
Edge Type	Attack Path
Affected Object Types	IAM Users
Exploitation Certainty	Certain
AWS IAM Action / Condition	`iam:DeleteAccessKey` for target IAM user

Description

AWS_DELETE_ACCESS_KEY is the ability to delete an existing access key from an IAM user.

On its own, this can disrupt service. In an attack chain, it is used to:

Clear a key slot when the target user already has two keys.
Create attacker-controlled credentials via AWS_CREATE_ACCESS_KEY.
Replace legitimate credentials with attacker-managed ones for persistence.

Identification

AWS CLI

Check whether a principal can delete access keys for a target user:

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:DeleteAccessKey \
  --resource-arns arn:aws:iam::123456789012:user/TargetUser

List existing target keys:

aws iam list-access-keys --user-name TargetUser

Exploitation

Delete an existing key:

aws iam delete-access-key \
  --user-name TargetUser \
  --access-key-id AKIAEXAMPLEKEYID

Common chain:

Delete key to free slot (AWS_DELETE_ACCESS_KEY).
Create attacker key (AWS_CREATE_ACCESS_KEY).

Mitigation

Restrict iam:DeleteAccessKey to dedicated identity lifecycle processes.
Separate key deletion and key creation duties where possible.
Alert when keys are deleted for high-value users outside approved windows.
Require change control for IAM credential management actions.

Detection

Monitor CloudTrail:

Event source: iam.amazonaws.com
Event name: DeleteAccessKey

Example lookup:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteAccessKey

Correlate with CreateAccessKey activity on the same user within a short window.

Ask AI