Evading Attribution & Moving Laterally on AWS

It is really not that difficult to find AWS credentials in the wild — from accidental github commits to plaintext keys in android apps decompiled on bevigil.

But in the end, everything gets logged. CloudTrail Event history will pinpoint the User / AccessKey that made the AWS API Calls. Hence it is important to evade attribution and keep the found credentials (Access Keys, Tokens) valid for a longer time if at all possible.

Here is the result of one such …

attribution aws aws-iam aws-security cloud cloud security moving