Check ID: cloudtrail_threat_detection_privilege_escalation
Provider: AWS
Service: cloudtrail
Severity: CRITICAL
Categories: threat-detection
Resource type: AwsCloudTrailTrail

​
What this check verifies

CloudTrail activity is analyzed for identities executing high-risk actions linked to privilege escalation (e.g., Attach*Policy, PassRole, AssumeRole, CreateAccessKey). Identities exceeding a configurable share of such events within a recent time window are highlighted for investigation.

​
Risk

Escalation patterns can grant elevated entitlements, enabling:
  • Confidentiality loss via unauthorized data/secret access
  • Integrity compromise by changing IAM policies/roles
  • Availability impact by tampering with logging or resources This also facilitates lateral movement and persistence.

​
Recommendation

Apply least privilege and defense in depth:
  • Restrict PassRole, Attach*Policy, UpdateAssumeRolePolicy, CreateAccessKey
  • Enforce permission boundaries and SCPs
  • Require MFA and change approvals
  • Use multi-Region CloudTrail, immutable retention, and alerting on anomalous sequences

​
Remediation

# SCP to block common IAM privilege-escalation actions
resource "aws_organizations_policy" "<example_resource_name>" {
  name = "deny-iam-privesc"
  type = "SERVICE_CONTROL_POLICY"

  # Critical: Deny risky IAM actions to prevent future privesc
  # Explanation: Blocks escalation techniques commonly seen in CloudTrail
  content = jsonencode({
    Version   = "2012-10-17",
    Statement = [
      {
        Effect   = "Deny",
        Action   = [
          "iam:AttachUserPolicy",
          "iam:AttachRolePolicy",
          "iam:PutUserPolicy",
          "iam:PutRolePolicy",
          "iam:PutGroupPolicy",
          "iam:AddUserToGroup",
          "iam:CreateAccessKey",
          "iam:CreateLoginProfile",
          "iam:UpdateLoginProfile",
          "iam:UpdateAssumeRolePolicy",
          "iam:CreatePolicyVersion",
          "iam:SetDefaultPolicyVersion",
          "iam:PassRole"
        ],
        Resource = "*"
      }
    ]
  })
}

resource "aws_organizations_policy_attachment" "<example_resource_name>_attach" {
  # Critical: Attach the SCP so it takes effect
  policy_id = aws_organizations_policy.<example_resource_name>.id
  target_id = "<example_resource_id>" # OU, Root, or Account ID
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudtrail_threat_detection_privilege_escalation. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks