When an attacker grabs valid Amazon Web Services (AWS) credentials—or hijacks a session—it can kick off a stealthy series of steps that may end in full-blown cloud breaches. AWS researchers recently published guidance that lays out precisely how threat actors transform hashed access into full control, if defenders fail to spot the signs early. It’s a roadmap from initial access all the way to data theft. Understanding each phase isn’t just academic—it’s essential for stopping cloud compromise before it’s too late.
The Five Stages of an Attack Unlocked
AWS identifies five critical stages in credential-based attacks: initial access, discovery, privilege escalation, lateral movement, and exfiltration. Through logs and metrics—CloudTrail for API events, VPC Flow Logs for network paths, and DNS resolver logs for domain lookups—security teams can reconstruct an attacker’s journey. What often looks innocuous in isolation—List, Describe, Get calls or access denied errors—may, when chained together, show reconnaissance or escalation in action.
Attackers, for example, frequently test a stolen credential by making API calls such as GetCallerIdentity or AssumeRole. Discovery follows, with enumeration—List or Describe calls—aimed at resources and permissions. Failed attempts, especially many AccessDenied responses, can tip off an attacker about security boundaries. In escalation, the intruder may deploy policy changes (AttachUserPolicy, PutRolePolicy), spin up new access keys, or exploit role chains to inflate privileges.
Once elevated, the attacker may move laterally—accessing storage (like buckets), invoking GetObject, and pairing that with outbound data transfers. Combining sensitive data reads with DNS activity aimed at new or previously unseen domains is a red flag. Exfiltration may be subtle, but when storage access patterns spike or data leaves the network—especially from buckets marked sensitive—the threat is real.
How AWS Suggests Detecting the Undetectable
To spot these threats, AWS urges use of multiple log sources—CloudTrail, VPC Flow, and Route 53 Resolver—and recommends tuning tools like GuardDuty to leverage local, context-aware threat signals. Knowing which buckets are sensitive, which role-chains are approved, and setting clear thresholds (e.g. read volume above the 95th percentile) are key elements.
Alert fatigue and delayed logs can leave gaps. CloudTrail, for instance, may deliver management events but not data events like GetObject unless explicitly enabled. AWS warns that delays of 5–15 minutes in log delivery can obscure the actual timeframe of malicious events. Correlating identity events, network signals, and storage access within tight time windows—ideally 10–30 minutes—can expose suspicious behavior.
Incident response also depends on quick results: review unfamiliar identities, revoke exposed credentials, preserve logs before they’re overwritten or disabled. Above all, privilege hygiene—least privilege practice, documenting roles and owners, defining approved role chains—is critical. Starting with one well-tuned rule and expanding only after it proves effective helps prevent noise, reduces risk and enables more precise detection.
These insights matter because cloud environments have grown heterogeneous and fast-moving. Through phishing, third-party compromise or AI-driven attacks, credential theft is increasingly the linchpin for deep access. AWS’s guidance shows that treating identity—not just single alert types—as the thread that links everything together is often what separates a stopped intrusion from a breach in waiting.
What to watch now: teams should track developments in tooling that automates correlation—across identity, network and storage logs—and how vendors embed context intelligence into their detection platforms. As attack chains compress in time, visibility and speed aren’t optional—they’re your last line of defense.
