RemoveUserFromGroup
AWS
RemoveUserFromGroup
Event
Removes an IAM user from a group, revoking the permissions that group membership conferred.
Security Context
- Removing a user from a group strips whatever permissions the group granted. Routinely this is offboarding or a role change; adversarially it is used to strip a defender or break-glass admin of their privileges mid-incident, slowing or blocking the response.
- The action changes access, not stored data — its impact is on who can act, which makes it a denial move against responders rather than a destructive one against resources.
Log Source
CloudTrail
Sample Event
Adversarial. During active compromise, Draco removes the on-call IAM admin hermione from the Administrators group. Hermione has already been paged on the intrusion; stripping her admin membership is an attempt to keep her from revoking Draco’s access or quarantining resources while he finishes. The removal targets another user (userIdentity.userName != requestParameters.userName), which — combined with the target being a privileged group — is the notable pattern here.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "ASIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T22:41:07Z", "eventSource": "iam.amazonaws.com", "eventName": "RemoveUserFromGroup", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "groupName": "Administrators", "userName": "hermione" }, "responseElements": null, "requestID": "90000000-0000-4000-8000-000001101010", "eventID": "90000000-0000-4000-8000-000001101011", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "iam.amazonaws.com" }}Analyst Notes
- Routine for this event: offboarding, team changes, and least-privilege cleanup — typically the caller is an IAM admin or an automation principal, the target is an ordinary user, and it coincides with related lifecycle events (
RemoveUserFromGroupfor several groups,DeleteLoginProfile,DeactivateMFADevice). - Notable: a removal that targets a privileged group (
Administrators, break-glass, security-tooling groups), a removal of a user other than the caller during an already-suspicious session, or a burst of removals stripping multiple responders at once. - Pair with
AddUserToGroupwhen reconstructing group-membership churn — an add followed shortly by a remove (or vice versa) on the same privileged group is worth reading as a single sequence.
Key Fields
requestParameters.groupName— which group the user was removed from; privileged group names raise the priority.requestParameters.userName— the user losing access; compare against the caller and against your responder/break-glass roster.userIdentity.arn/userName— who performed the removal; self-service vs admin vs automation changes the baseline.sourceIPAddress,userAgent,sessionContext.mfaAuthenticated— provenance of the call; non-MFA admin actions from unfamiliar IPs are higher signal.
References
MITRE ATT&CK Mapping
Tactics: Impact
Techniques:
- T1531 — Account Access Removal — Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts....