AWS CreateAccessKey

This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user. Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions. Hunting queries are designed to be run manually during threat hunting activities.