New Cloud Account Created via IAM API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects the creation of a new cloud account (user) in Amazon Web Services (AWS) via the Identity and Access Management (IAM) API. It specifically looks for HTTP traffic to 'iam.amazonaws.com' with 'CreateUser' in the URI, indicating an attempt to create a new IAM user.