> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_create_access_key.md).

# AWS\_CREATE\_ACCESS\_KEY

## Summary

|                                |                                           |
| ------------------------------ | ----------------------------------------- |
| **Forestall ACL Alias**        | AWS\_CREATE\_ACCESS\_KEY                  |
| **Edge Type**                  | Attack Path                               |
| **Affected Object Types**      | IAM Users                                 |
| **Exploitation Certainty**     | Certain                                   |
| **AWS IAM Action / Condition** | `iam:CreateAccessKey` for target IAM user |

## Description

`AWS_CREATE_ACCESS_KEY` is the ability to create long-term API credentials for an IAM user.

An attacker with this permission generates a new key pair for a privileged user and authenticates as that user via the AWS CLI or SDK. Credentials persist until someone revokes them. If key governance is weak, they can sit undetected for months.

When the target already has two keys (the IAM limit), this path chains with [`AWS_DELETE_ACCESS_KEY`](https://docs.forestall.io/fsprotect/edges/aws/aws_delete_access_key).

## Identification

### AWS CLI

Check permission simulation.

```bash
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:CreateAccessKey \
  --resource-arns arn:aws:iam::123456789012:user/TargetUser
```

Review current keys on the target user.

```bash
aws iam list-access-keys --user-name TargetUser
```

### AWS Console

* Open **IAM** -> **Users** -> select the target user.
* Open **Security credentials** tab.
* Under **Access keys**, verify whether the user already has 0, 1, or 2 active keys.
* To find who can create access keys for this user, check the **Permissions** tab of potential source users/roles for the `iam:CreateAccessKey` permission.

## Exploitation

Create a key for the target user.

```bash
aws iam create-access-key --user-name TargetUser
```

Use the returned `AccessKeyId` and `SecretAccessKey` with the AWS CLI or SDK to act as that user.

## Mitigation

* Restrict `iam:CreateAccessKey` to dedicated break-glass workflows.
* Prefer temporary STS credentials over long-term user keys.
* Rotate keys regularly and revoke unused ones immediately.
* Apply SCP and IAM guardrails to block user key creation where not required.

## Detection

Monitor CloudTrail for access key creation.

* **Event source**: `iam.amazonaws.com`
* **Event name**: `CreateAccessKey`

Example lookup.

```bash
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateAccessKey
```

Prioritize events where the caller is creating a key for a different user.

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccessKeys.html>
* <https://docs.aws.amazon.com/general/latest/gr/iam-service.html>
* <https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html>