AWS IAM Role Assumed for Temporary Elevated Access

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects when an AWS IAM role is assumed, which can be a legitimate activity for temporary elevated access within an AWS environment. The detection is based on HTTP traffic to 'sts.amazonaws.com' with 'AssumeRole' in the URI, indicating a request to the AWS Security Token Service to assume an IAM role. This activity is often associated with privilege escalation techniques.