« AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity AWS Batch Job Submitted with Container Override by Unusual Identity »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.29

AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity

edit

Detects the first time an AWS identity successfully deletes an IAM managed policy whose ARN contains guardrail-related keywords (for example Boundary, Deny, Restrict, Guard, SCP, Guardrail). Adversaries who have obtained elevated IAM privileges may delete policies to remove restrictive permissions boundaries, eliminate deny-based guardrails, or clean up after a privilege escalation operation. Infrastructure-as-code tools (Terraform, CloudFormation, Pulumi, and Ansible) are excluded because policy lifecycle management is a routine part of automated deployments. A policy deletion by an identity not seen performing this activity during the prior seven days may indicate newly compromised credentials being used to modify the account’s permission structure.

Rule type: new_terms

Rule indices:

  • logs-aws.cloudtrail-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Data Source: AWS
  • Data Source: Amazon Web Services
  • Data Source: AWS IAM
  • Use Case: Identity and Access Audit
  • Tactic: Defense Evasion
  • Tactic: Persistence
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity

This rule fires the first time an identity deletes a customer-managed IAM policy in the prior 7 days. Policy deletion is a privilege-escalation or defense-evasion primitive: removing a deny-based policy or permissions boundary silently expands the effective access of every principal that policy applied to.

Possible investigation steps

  • Identify the deleting principal (aws.cloudtrail.user_identity.arn) and determine whether they have a history of IAM policy management in audit logs beyond the 7-day window.
  • Review aws.cloudtrail.request_parameters to identify the policy ARN that was deleted. Policies with names containing "Boundary", "Deny", or "Restrict" in the ARN are highest priority.
  • Check whether any principal previously had this policy attached as a permissions boundary — if so, those principals may now operate without that constraint.
  • Review the same identity’s CloudTrail activity for other IAM privilege escalation indicators in the same session: CreatePolicyVersion, SetDefaultPolicyVersion, AttachRolePolicy, UpdateAssumeRolePolicy.
  • Determine whether this identity was recently assumed via AssumeRole from an unusual source IP.

False positive analysis

  • First-time IaC deployments (Terraform apply, CDK deploy) that manage IAM resources will appear as new identities performing policy deletions.
  • New service accounts introduced to handle IAM lifecycle management.

Response and remediation

  • If unauthorized, determine whether the deleted policy was a permissions boundary and re-apply it immediately to all affected principals.
  • Revoke or disable the credentials used to perform the deletion pending investigation.
  • Review all principals that had the policy attached and audit their current effective permissions.

Setup

edit

The AWS CloudTrail integration must be enabled and configured to collect IAM management events.

Rule query

edit
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "iam.amazonaws.com"
    and event.action: "DeletePolicy"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and aws.cloudtrail.request_parameters: (*Boundary* or *boundary* or *Deny* or *deny* or *Restrict* or *restrict* or *Guard* or *guard* or *SCP* or *Guardrail* or *guardrail*)
    and not user_agent.original: (*Terraform* or *terraform* or "cloudformation.amazonaws.com" or *pulumi* or *Pulumi* or *ansible* or *Ansible*)

Framework: MITRE ATT&CKTM

« AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity AWS Batch Job Submitted with Container Override by Unusual Identity »