AWS IAM Activity From EC2 Instance

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•1•0•48

Detects AWS IAM activities originating from an EC2 instance that could be used to retain access or escalate privileges. This includes actions like creating users, attaching policies, creating/updating login profiles, creating access keys, creating groups, and creating roles.