AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN
Detects successful `AssumeRoleWithWebIdentity` where the caller identity is a Kubernetes service account and the source autonomous system organization is present but not `Amazon.com, Inc.` EKS workloads that obtain…
Description
Detects successful `AssumeRoleWithWebIdentity` where the caller identity is a Kubernetes service account and the source autonomous system organization is present but not `Amazon.com, Inc.` EKS workloads that obtain IAM credentials via IAM Roles for Service Accounts (IRSA) normally reach STS from AWS-managed or AWS-associated networks; the same identity from a clearly external ASN can indicate a stolen or misused projected service-account token being exchanged for IAM credentials off-cluster.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source category
- event_index
Known benign triggers
- Traffic may leave the cluster via corporate proxies, VPNs, or non-AWS NAT providers that populate a non-Amazon ASN organization name while still being legitimate. AWS IP ranges are also labeled with other organization strings (for example `AMAZON-02`); this rule only excludes `Amazon.com, Inc.` per the match condition—tune with additional approved ASNs, CIDRs, or known automation identities if needed.
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html | 2 |
| docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html | 2 |
From the source
- At source
- Open at source
- Upstream identifier
- ae32268b-bfd0-4c35-b002-13461b5830ca
- Tagged by the source as
- Data Source: Amazon Web ServicesData Source: AWSData Source: AWS CloudTrailDomain: CloudDomain: IdentityNoise: HighPerformance: FastPlatform: AWSProfile: AggressiveResources: Investigation GuideRule Type: Custom Query (KQL)Service: AWS STSTactic: Initial AccessUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Sep 20, 2026
- Version
- 4