Root Account Access Key Created

AnalysisType: rule
Filename: aws_root_access_key_created.py
RuleID: "AWS.CloudTrail.RootAccessKeyCreated"
DisplayName: "Root Account Access Key Created"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Identity and Access Management
  - Persistence:Account Manipulation
Reports:
  MITRE ATT&CK:
    - TA0003:T1098
Severity: Critical
Description: >
  Detects creation of programmatic access keys for the AWS root account, which violates critical security best practices. Root account credentials provide unrestricted access to all AWS resources and cannot be scoped with granular permissions. If compromised, these keys grant attackers complete control over the AWS environment including billing and account closure capabilities.
Runbook: |
  1. Query CloudTrail for all API calls where userIdentity.accessKeyId matches responseElements.accessKey.accessKeyId in the 24 hours after the key creation to identify all actions taken using the root access key
  2. Check if the root account credentials may be compromised by reviewing sourceIPAddress and userAgent against known legitimate access patterns, then verify with the account owner if this creation was authorized
  3. Search CloudTrail for IAM policy modifications, user creations, role changes, and resource deletions by userIdentity.type="Root" in the 6 hours around this event to identify unauthorized changes made using root credentials
Reference: https://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html
SummaryAttributes:
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: Root Access Key Created
    ExpectedResult: true
    Log:
      {
        "awsRegion": "us-east-1",
        "eventID": "1111",
        "eventName": "CreateAccessKey",
        "eventSource": "iam.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsApiCall",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters": null,
        "responseElements":
          {
            "accessKey":
              {
                "accessKeyId": "1111",
                "createDate": "Jan 01, 2019 0:00:00 PM",
                "status": "Active",
              },
          },
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "signin.amazonaws.com",
        "userIdentity":
          {
            "accessKeyId": "1111",
            "accountId": "123456789012",
            "arn": "arn:aws:iam::123456789012:root",
            "invokedBy": "signin.amazonaws.com",
            "principalId": "123456789012",
            "sessionContext":
              {
                "attributes":
                  {
                    "creationDate": "2019-01-01T00:00:00Z",
                    "mfaAuthenticated": "true",
                  },
              },
            "type": "Root",
          },
      }
  - Name: Root Created Access Key For User
    ExpectedResult: false
    Log:
      {
        "awsRegion": "us-east-1",
        "eventID": "1111",
        "eventName": "CreateAccessKey",
        "eventSource": "iam.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsApiCall",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters": { "userName": "example-user" },
        "responseElements":
          {
            "accessKey":
              {
                "accessKeyId": "1111",
                "createDate": "Jan 01, 2019 0:00:00 PM",
                "status": "Active",
                "userName": "example-user",
              },
          },
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "signin.amazonaws.com",
        "userIdentity":
          {
            "accessKeyId": "1111",
            "accountId": "123456789012",
            "arn": "arn:aws:iam::123456789012:root",
            "invokedBy": "signin.amazonaws.com",
            "principalId": "123456789012",
            "sessionContext":
              {
                "attributes":
                  {
                    "creationDate": "2019-01-01T00:00:00Z",
                    "mfaAuthenticated": "true",
                  },
              },
            "type": "Root",
          },
      }


# ------ paired body: aws_root_access_key_created.py ------

from panther_aws_helpers import aws_rule_context


def rule(event):
    # Only check access key creation events
    if event.get("eventName") != "CreateAccessKey":
        return False

    # Only root can create root access keys
    if event.deep_get("userIdentity", "type") != "Root":
        return False

    # Only alert if the root user is creating an access key for itself
    return event.get("requestParameters") is None


def alert_context(event):
    return aws_rule_context(event)