Additional Cloud Credentials Added to IAM User

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects when additional cloud credentials (Access Keys) are added to an AWS IAM user. It specifically looks for HTTP traffic to 'iam.amazonaws.com' containing 'CreateAccessKey' in the URI, indicating an attempt to create new access keys.