IAM Role Added to RDS Instance or Cluster

Description

Detects when IAM roles are added to RDS instances or clusters. While legitimate for features like S3 import/export, attackers may add overly permissive roles to maintain access or escalate privileges for data exfiltration.

Query · python

from panther_aws_helpers import aws_rds_context


def rule(event):
    if event.get("eventSource") != "rds.amazonaws.com":
        return False
    role_events = ["AddRoleToDBInstance", "AddRoleToDBCluster"]
    if event.get("eventName") not in role_events:
        return False
    return event.deep_get("errorCode") is None


def title(event):
    event_name = event.get("eventName", "Unknown")
    db_identifier = event.deep_get("requestParameters", "dBInstanceIdentifier") or event.deep_get(
        "requestParameters", "dBClusterIdentifier", default="<UNKNOWN>"
    )
    role_arn = event.deep_get("requestParameters", "roleArn", default="<UNKNOWN_ROLE>")
    user = event.deep_get("userIdentity", "userName") or event.deep_get(
        "userIdentity", "principalId", default="<UNKNOWN_USER>"
    )
    resource_type = "Instance" if event_name == "AddRoleToDBInstance" else "Cluster"
    return f"IAM Role Added to RDS {resource_type}: [{db_identifier}] role [{role_arn}] by [{user}]"


def dedup(event):
    db_identifier = event.deep_get("requestParameters", "dBInstanceIdentifier") or event.deep_get(
        "requestParameters", "dBClusterIdentifier", default="unknown"
    )
    account_id = event.deep_get("recipientAccountId", default="unknown")
    region = event.get("awsRegion", "unknown")
    return f"{account_id}:{region}:{db_identifier}"


def alert_context(event):
    context = aws_rds_context(event)
    context["role_arn"] = event.deep_get("requestParameters", "roleArn", default="N/A")
    context["feature_name"] = event.deep_get("requestParameters", "featureName", default="N/A")
    return context

Analyst notes

  1. Find all IAM role additions by the user ARN in the past 24 hours
  2. Check if this user has added IAM roles to databases in the past 90 days to determine if this is normal behavior
  3. Look for data export or modification operations from this database in the 48 hours after the role was added
Raw source IAM Role Added to RDS Instance or Cluster · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: aws_rds_iam_role_added.py
RuleID: "AWS.RDS.IAMRoleAdded"
DisplayName: "IAM Role Added to RDS Instance or Cluster"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Persistence
  - Privilege Escalation
  - Additional Cloud Credentials
  - RDS
Severity: Medium
Description: >
  Detects when IAM roles are added to RDS instances or clusters. While legitimate for features
  like S3 import/export, attackers may add overly permissive roles to maintain access or
  escalate privileges for data exfiltration.
Runbook: |
  1. Find all IAM role additions by the user ARN in the past 24 hours
  2. Check if this user has added IAM roles to databases in the past 90 days to determine if this is normal behavior
  3. Look for data export or modification operations from this database in the 48 hours after the role was added
Reference: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PostgreSQL.S3Import.html
Reports:
  MITRE ATT&CK:
    - TA0003:T1098.001  # Additional Cloud Credentials
    - TA0004:T1078.004  # Cloud Accounts
DedupPeriodMinutes: 60
SummaryAttributes:
  - eventName
  - userIdentity:principalId
  - requestParameters:dBInstanceIdentifier
  - requestParameters:dBClusterIdentifier
  - requestParameters:roleArn
  - p_any_aws_account_ids
Threshold: 1
Tests:
  - Name: Role Added to DB Instance
    ExpectedResult: true
    Log:
      eventVersion: "1.08"
      userIdentity:
        type: AssumedRole
        principalId: "AIDAI23HXS3EXAMPLE:user"
        arn: "arn:aws:sts::123456789012:assumed-role/DBARole/user"
        accountId: "123456789012"
        accessKeyId: "ASIAIOSFODNN7EXAMPLE"
      eventTime: "2024-01-17T13:00:00Z"
      eventSource: rds.amazonaws.com
      eventName: AddRoleToDBInstance
      awsRegion: us-east-1
      sourceIPAddress: "10.0.1.100"
      userAgent: "aws-cli/2.13.0"
      requestParameters:
        dBInstanceIdentifier: "production-postgres"
        roleArn: "arn:aws:iam::123456789012:role/RDS-S3-Import-Role"
        featureName: "s3Import"
      responseElements:
        dBInstanceIdentifier: "production-postgres"
        associatedRoles:
          - roleArn: "arn:aws:iam::123456789012:role/RDS-S3-Import-Role"
            featureName: "s3Import"
            status: "PENDING"
      requestID: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
      eventID: "f1e2d3c4-b5a6-7890-1234-567890abcdef"
      readOnly: false
      eventType: AwsApiCall
      managementEvent: true
      recipientAccountId: "123456789012"
      eventCategory: Management

  - Name: Role Added to DB Cluster
    ExpectedResult: true
    Log:
      eventVersion: "1.08"
      userIdentity:
        type: IAMUser
        principalId: "AIDAI23HXS3EXAMPLE"
        arn: "arn:aws:iam::123456789012:user/developer"
        accountId: "123456789012"
        accessKeyId: "AKIAIOSFODNN7EXAMPLE"
        userName: developer
      eventTime: "2024-01-17T13:00:00Z"
      eventSource: rds.amazonaws.com
      eventName: AddRoleToDBCluster
      awsRegion: us-west-2
      sourceIPAddress: "203.0.113.75"
      userAgent: "Boto3/1.26.0"
      requestParameters:
        dBClusterIdentifier: "aurora-cluster-prod"
        roleArn: "arn:aws:iam::123456789012:role/RDS-Lambda-Access"
        featureName: "Lambda"
      responseElements:
        dBClusterIdentifier: "aurora-cluster-prod"
        associatedRoles:
          - roleArn: "arn:aws:iam::123456789012:role/RDS-Lambda-Access"
            featureName: "Lambda"
            status: "PENDING"
      requestID: "b2c3d4e5-f6a7-8901-bcde-f1234567890a"
      eventID: "g2f3e4d5-c6b7-8901-2345-678901bcdefg"
      readOnly: false
      eventType: AwsApiCall
      managementEvent: true
      recipientAccountId: "123456789012"
      eventCategory: Management

  - Name: Role Addition Failed
    ExpectedResult: false
    Log:
      eventVersion: "1.08"
      userIdentity:
        type: IAMUser
        principalId: "AIDAI23HXS3EXAMPLE"
        arn: "arn:aws:iam::123456789012:user/contractor"
        accountId: "123456789012"
        accessKeyId: "AKIAIOSFODNN7EXAMPLE"
        userName: contractor
      eventTime: "2024-01-17T13:00:00Z"
      eventSource: rds.amazonaws.com
      eventName: AddRoleToDBInstance
      awsRegion: us-east-1
      sourceIPAddress: "198.51.100.50"
      userAgent: "aws-cli/2.13.0"
      requestParameters:
        dBInstanceIdentifier: "production-db"
        roleArn: "arn:aws:iam::123456789012:role/Admin-Role"
      errorCode: AccessDenied
      errorMessage: "User is not authorized to perform: rds:AddRoleToDBInstance"
      requestID: "c3d4e5f6-a7b8-9012-cdef-1234567890ab"
      eventID: "h3g4f5e6-d7c8-9012-3456-789012cdefgh"
      readOnly: false
      eventType: AwsApiCall
      managementEvent: true
      recipientAccountId: "123456789012"
      eventCategory: Management

  - Name: Different RDS Event
    ExpectedResult: false
    Log:
      eventVersion: "1.08"
      userIdentity:
        type: AssumedRole
        principalId: "AIDAI23HXS3EXAMPLE:user"
        arn: "arn:aws:sts::123456789012:assumed-role/Admin/user"
        accountId: "123456789012"
      eventTime: "2024-01-17T13:00:00Z"
      eventSource: rds.amazonaws.com
      eventName: RemoveRoleFromDBInstance
      awsRegion: us-east-1
      sourceIPAddress: "10.0.1.100"
      requestParameters:
        dBInstanceIdentifier: "production-db"
        roleArn: "arn:aws:iam::123456789012:role/OldRole"
      requestID: "d4e5f6a7-b8c9-0123-def0-1234567890bc"
      eventID: "i4h5g6f7-e8d9-0123-4567-890123defghi"
      readOnly: false
      eventType: AwsApiCall
      managementEvent: true
      recipientAccountId: "123456789012"
      eventCategory: Management


# ------ paired body: aws_rds_iam_role_added.py ------

from panther_aws_helpers import aws_rds_context


def rule(event):
    if event.get("eventSource") != "rds.amazonaws.com":
        return False
    role_events = ["AddRoleToDBInstance", "AddRoleToDBCluster"]
    if event.get("eventName") not in role_events:
        return False
    return event.deep_get("errorCode") is None


def title(event):
    event_name = event.get("eventName", "Unknown")
    db_identifier = event.deep_get("requestParameters", "dBInstanceIdentifier") or event.deep_get(
        "requestParameters", "dBClusterIdentifier", default="<UNKNOWN>"
    )
    role_arn = event.deep_get("requestParameters", "roleArn", default="<UNKNOWN_ROLE>")
    user = event.deep_get("userIdentity", "userName") or event.deep_get(
        "userIdentity", "principalId", default="<UNKNOWN_USER>"
    )
    resource_type = "Instance" if event_name == "AddRoleToDBInstance" else "Cluster"
    return f"IAM Role Added to RDS {resource_type}: [{db_identifier}] role [{role_arn}] by [{user}]"


def dedup(event):
    db_identifier = event.deep_get("requestParameters", "dBInstanceIdentifier") or event.deep_get(
        "requestParameters", "dBClusterIdentifier", default="unknown"
    )
    account_id = event.deep_get("recipientAccountId", default="unknown")
    region = event.get("awsRegion", "unknown")
    return f"{account_id}:{region}:{db_identifier}"


def alert_context(event):
    context = aws_rds_context(event)
    context["role_arn"] = event.deep_get("requestParameters", "roleArn", default="N/A")
    context["feature_name"] = event.deep_get("requestParameters", "featureName", default="N/A")
    return context

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.