AWS Organizations Root Assumption Activity

Lacey Cochrane@NullVectorX

•updated Aug 4, 2026•5•0•12

Detects the use of sts:AssumeRoot within an AWS Organization. This action allows an entity within the management account to assume root-level access in a member account, effectively bypassing standard IAM restrictions. This is a high-risk event indicative of potential privilege escalation or management account compromise.