CreateRole
AWS
CreateRole
Event
Creates a new IAM role with a trust policy that defines which principals are permitted to assume it.
Security Context
- Adversaries attach overly permissive policies to maintain persistent, elevated access even after initial credentials are rotated.
- Creating cloud accounts provides a durable backdoor that persists independently of any compromised user’s credentials.
Log Source
CloudTrail
Sample Event
Adversarial. Draco creates an IAM role named IncidentResponseSupport whose trust policy allows arn:aws:iam::555666661337:root (the adversary external account) to assume it. Once the role exists, Draco — operating from his own external infrastructure — can use long-term access keys in 555666661337 to call sts:AssumeRole and get full role-scoped credentials in the production account, completely independent of his compromised IAM user. Permissions are added in a follow-up AttachRolePolicy AdministratorAccess event.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-16T00:38:14Z", "eventSource": "iam.amazonaws.com", "eventName": "CreateRole", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "roleName": "IncidentResponseSupport", "description": "Cross-account incident response support role.", "assumeRolePolicyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::555666661337:root\"},\"Action\":\"sts:AssumeRole\"}]}", "maxSessionDuration": 43200 }, "responseElements": { "role": { "path": "/", "roleName": "IncidentResponseSupport", "roleId": "AROA0666BACKDOORROLE", "arn": "arn:aws:iam::555123456789:role/IncidentResponseSupport", "createDate": "Apr 16, 2026, 12:38:14 AM", "assumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22AWS%22%3A%22arn%3Aaws%3Aiam%3A%3A555666661337%3Aroot%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D" } }, "requestID": "90000000-0000-4000-8000-000010011010", "eventID": "90000000-0000-4000-8000-000010011011", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "iam.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Persistence Privilege Escalation
Techniques:
- T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include accoun...
- T1136.003 — Cloud Account — Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.