--- title: Rapid7 Labs: Investigating Persistence Mechanisms in AWS description: Attackers who gain access to AWS environments often establish persistence through IAM user creation, modified assume role policies, backdoored Lambda... canonical: https://daily.dev/posts/rapid7-labs-investigating-persistence-mechanisms-in-aws-qjvpcbpdq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rapid7 Labs: Investigating Persistence Mechanisms in AWS | daily.dev og:description: Attackers who gain access to AWS environments often establish persistence through IAM user creation, modified assume role policies, backdoored Lambda... og:url: https://daily.dev/posts/rapid7-labs-investigating-persistence-mechanisms-in-aws-qjvpcbpdq og:image: https://api.daily.dev/og/posts/QJVpcbpDq.png og:image:alt: Rapid7 Labs: Investigating Persistence Mechanisms in AWS og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rapid7 Labs: Investigating Persistence Mechanisms in AWS **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 15 min read · 0 upvotes · 0 comments ## Summary Attackers who gain access to AWS environments often establish persistence through IAM user creation, modified assume role policies, backdoored Lambda functions, and federated user sessions via STS GetFederationToken. Each technique is explained with real CloudTrail log examples, LEQL queries for InsightIDR to detect and investigate the activity, and concrete remediation steps. Key takeaways include: malicious IAM users need follow-up credential and permission actions to be useful; assume role policy backdoors allow external AWS accounts to assume roles indefinitely; Lambda functions can provision privileged users on demand via public URLs or API Gateway; and federated credentials persist even after the source access key is disabled, requiring a deny-all policy until expiry. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do attackers maintain persistence in AWS by modifying assume role policies? Attackers use iam:CreateRole with a backdoored trust policy or iam:UpdateAssumeRolePolicy to edit an existing role, adding an external AWS account ID as a trusted principal with sts:AssumeRole permission. This lets anyone with sufficient permissions in the attacker-controlled account assume the role in the victim's environment, surviving credential rotation of the original compromised identity. _Teams hardening AWS trust policies against hijacking can find detection query patterns like these through daily.dev._ ### Why doesn't disabling a compromised IAM user's access key stop an attacker who used STS GetFederationToken? Deleting or disabling the original access key does not invalidate temporary credentials already issued through GetFederationToken; those federated session credentials remain valid until they expire naturally, unless their effective permissions are explicitly blocked. Responders must treat the federated session as a separate active identity and investigate both it and the source IAM user together. _Incident responders tracking AWS federated-session risks can surface this kind of detail via daily.dev._ ### How do attackers use AWS Lambda functions to create a persistent admin backdoor? A malicious Lambda function can call iam.create_user, iam.create_login_profile, and iam.attach_user_policy with AdministratorAccess to spin up a new privileged IAM user with a password, returning the login URL and credentials in the function's response. The function is typically triggered via a public Lambda function URL (lambda:CreateFunctionUrlConfig plus lambda:AddPermission) or an API Gateway integration, letting the attacker invoke it externally on demand. _Developers securing serverless functions against backdoor abuse can track techniques like this on daily.dev._ ## Similar posts on daily.dev - [Fourth challenge on DevOpsLedger](https://daily.dev/posts/fourth-challenge-on-devopsledger-l6xk0k65f) · Medium · 0 upvotes · 0 comments - [Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign](https://daily.dev/posts/compromised-iam-credentials-power-a-large-aws-crypto-mining-campaign-84goyuz0s) · The Hacker News · 0 upvotes · 0 comments - [My AWS Account Got Hacked - Here Is What Happened](https://daily.dev/posts/my-aws-account-got-hacked---here-is-what-happened-eg2ax9ikr) · Tech Lead Digest · 13 upvotes · 3 comments - [Crypto crooks co-opt stolen AWS creds to mine coins](https://daily.dev/posts/crypto-crooks-co-opt-stolen-aws-creds-to-mine-coins-1jnwvi7wk) · The Register · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#aws-lambda](https://daily.dev/tags/aws-lambda), [#iam](https://daily.dev/tags/iam) [View this post on daily.dev](https://daily.dev/posts/rapid7-labs-investigating-persistence-mechanisms-in-aws-qjvpcbpdq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rapid7 Labs: Investigating Persistence Mechanisms in AWS","url":"https://daily.dev/posts/rapid7-labs-investigating-persistence-mechanisms-in-aws-qjvpcbpdq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rapid7-labs-investigating-persistence-mechanisms-in-aws-qjvpcbpdq"},"datePublished":"2026-07-15T13:19:05.817Z","dateModified":"2026-09-14T07:26:15.394Z","description":"Attackers who gain access to AWS environments often establish persistence through IAM user creation, modified assume role policies, backdoored Lambda...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0b503edeec4720a544618881eb5b4616?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0b503edeec4720a544618881eb5b4616?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rapid7-labs-investigating-persistence-mechanisms-in-aws-qjvpcbpdq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,aws-lambda,iam","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"Rapid7 Labs: Investigating Persistence Mechanisms in AWS"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rapid7-labs-investigating-persistence-mechanisms-in-aws-qjvpcbpdq#faq","mainEntity":[{"@type":"Question","name":"How do attackers maintain persistence in AWS by modifying assume role policies?","acceptedAnswer":{"@type":"Answer","text":"Attackers use iam:CreateRole with a backdoored trust policy or iam:UpdateAssumeRolePolicy to edit an existing role, adding an external AWS account ID as a trusted principal with sts:AssumeRole permission. This lets anyone with sufficient permissions in the attacker-controlled account assume the role in the victim's environment, surviving credential rotation of the original compromised identity. Teams hardening AWS trust policies against hijacking can find detection query patterns like these through daily.dev."}},{"@type":"Question","name":"Why doesn't disabling a compromised IAM user's access key stop an attacker who used STS GetFederationToken?","acceptedAnswer":{"@type":"Answer","text":"Deleting or disabling the original access key does not invalidate temporary credentials already issued through GetFederationToken; those federated session credentials remain valid until they expire naturally, unless their effective permissions are explicitly blocked. Responders must treat the federated session as a separate active identity and investigate both it and the source IAM user together. Incident responders tracking AWS federated-session risks can surface this kind of detail via daily.dev."}},{"@type":"Question","name":"How do attackers use AWS Lambda functions to create a persistent admin backdoor?","acceptedAnswer":{"@type":"Answer","text":"A malicious Lambda function can call iam.create_user, iam.create_login_profile, and iam.attach_user_policy with AdministratorAccess to spin up a new privileged IAM user with a password, returning the login URL and credentials in the function's response. The function is typically triggered via a public Lambda function URL (lambda:CreateFunctionUrlConfig plus lambda:AddPermission) or an API Gateway integration, letting the attacker invoke it externally on demand. Developers securing serverless functions against backdoor abuse can track techniques like this on daily.dev."}}]} ```