AssumeRole

AWS

AssumeRole

service: AWS - STS

tactics:

Initial Access Privilege Escalation Lateral Movement Stealth

techniques:

T1078.004 T1550.001

tags:

AWS STS

Event

AssumeRole requests temporary credentials for an IAM role. Successful credentials act as a role session, subject to applicable policies; assuming a role does not automatically confer administrator access. AWS API reference.

Security Context

The useful signal is the relationship between the caller, target role, and subsequent actions. An unfamiliar cross-account assumption or an unexpected jump to a privileged role deserves review.

Legitimate uses: deployment tooling, approved cross-account administration, and applications switching into a designated role. Compare against known caller-to-role relationships, rather than alerting on every assumption.

Mapping rationale: a compromised cloud identity can use trusted role access for entry, movement, or increased privileges. These are contextual possibilities, not outcomes proved by every AssumeRole record. OIDC and SAML federation use distinct APIs; do not treat their events as interchangeable with this one.

Log Source

CloudTrail records this STS operation as a read management event, even though it issues credentials. A write-only feed can miss it. Search for eventSource: sts.amazonaws.com and eventName: AssumeRole. Check the endpoint used when determining where to collect and search records. IAM and STS logging.

Key Fields

Field	Investigation use
`userIdentity.arn`	Identify the caller, including an existing assumed-role session.
`requestParameters.roleArn`	Identify the target role and account.
`requestParameters.roleSessionName` and `sourceIdentity`	Correlation clues when present; a plausible session name is not proof of a trusted caller.
`responseElements.assumedRoleUser.arn`	Identify the resulting role session on success.
`responseElements.credentials.accessKeyId`	Pivot to later events whose `userIdentity.accessKeyId` matches this temporary key.
`errorCode` and `errorMessage`	Distinguish a denied assumption from issued credentials.

What to Investigate

Check whether the caller-to-role relationship is expected. Compare the request with a deployment, support session, or approved cross-account workflow.
Inspect the target role’s trust and permission policies. Look for preceding UpdateAssumeRolePolicy activity that could have opened access.
Trace subsequent API calls using the returned key ID and role-session identity. Examine sensitive reads, permission changes, and StopLogging, rather than treating credential issuance as the end of the investigation.
If the caller was already an assumed role, work backward through that session as well. Record any missing source-account or target-account evidence.

Sample Event

Synthetic scenario — expected administration. Hermione assumes GraphornAdminRole from her IAM user. The returned session ARN and temporary access key ID illustrate the pivot into later activity. The token value is a placeholder; no usable credential is included.

{
    "eventVersion": "1.09",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AIDAHERM10NE000ADM1N",
        "arn": "arn:aws:iam::555123456789:user/hermione",
        "accountId": "555123456789",
        "accessKeyId": "ASIAHERM10NEEXAMPLE1",
        "userName": "hermione"
    },
    "eventTime": "2026-04-15T13:42:11Z",
    "eventSource": "sts.amazonaws.com",
    "eventName": "AssumeRole",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "198.51.100.42",
    "userAgent": "aws-cli/2.15.30 Python/3.11.6 Linux/5.15.0-1052-aws exe/x86_64.ubuntu.22 prompt/off command/sts.assume-role",
    "requestParameters": {
        "roleArn": "arn:aws:iam::555123456789:role/GraphornAdminRole",
        "roleSessionName": "hermione-graphorn-session",
        "sourceIdentity": "hermione",
        "durationSeconds": 3600
    },
    "responseElements": {
        "credentials": {
            "accessKeyId": "ASIAGRAPH0RNSESS1ON1",
            "sessionToken": "<encoded session token blob>",
            "expiration": "Apr 15, 2026, 2:42:11 PM"
        },
        "assumedRoleUser": {
            "assumedRoleId": "AROAGRAPH0RNADM1NR01:hermione-graphorn-session",
            "arn": "arn:aws:sts::555123456789:assumed-role/GraphornAdminRole/hermione-graphorn-session"
        },
        "sourceIdentity": "hermione"
    },
    "requestID": "90000000-0000-4000-8000-000000000001",
    "eventID": "90000000-0000-4000-8000-000000000010",
    "readOnly": true,
    "resources": [
        {
            "accountId": "555123456789",
            "type": "AWS::IAM::Role",
            "ARN": "arn:aws:iam::555123456789:role/GraphornAdminRole"
        }
    ],
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "555123456789",
    "eventCategory": "Management",
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "sts.us-east-1.amazonaws.com"
    }
}

Sources

MITRE ATT&CK Mapping

Tactics: Initial Access Privilege Escalation Lateral Movement Stealth

Techniques:

T1078.004 — Cloud Accounts — Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of r...
T1550.001 — Application Access Token — Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

AssumeRole

Event

Security Context

Log Source

Key Fields

What to Investigate

Sample Event

Sources

MITRE ATT&CK Mapping

Related Events