AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN

  1[metadata]
  2creation_date = "2026/04/22"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/06/01"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects successful `AssumeRoleWithWebIdentity` where the caller identity is a Kubernetes service account and the source 
 11autonomous system organization is present but not `Amazon.com, Inc.` EKS workloads that obtain IAM credentials via IAM Roles 
 12for Service Accounts (IRSA) normally reach STS from AWS-managed or AWS-associated networks; the same identity from a clearly 
 13external ASN can indicate a stolen or misused projected service-account token being exchanged for IAM credentials off-cluster.
 14"""
 15false_positives = [
 16    """
 17    Traffic may leave the cluster via corporate proxies, VPNs, or non-AWS NAT providers that populate a non-Amazon ASN
 18    organization name while still being legitimate. AWS IP ranges are also labeled with other organization strings
 19    (for example `AMAZON-02`); this rule only excludes `Amazon.com, Inc.` per the match condition—tune with additional
 20    approved ASNs, CIDRs, or known automation identities if needed.
 21    """,
 22]
 23from = "now-6m"
 24index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 25interval = "5m"
 26language = "kuery"
 27license = "Elastic License v2"
 28name = "AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN"
 29note = """## Triage and analysis
 30
 31### Investigating AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN
 32
 33IRSA maps a Kubernetes service account to an IAM role via OIDC. CloudTrail records `AssumeRoleWithWebIdentity` with
 34`user.name` like `system:serviceaccount:<namespace>:<sa>`. If geolocation/ASN enrichment shows a non-Amazon source
 35organization while the identity is still a cluster service account, validate whether the token could have been used
 36outside the cluster (exfiltrated JWT, misrouted traffic, or operator tooling).
 37
 38### Possible investigation steps
 39
 40- Confirm `event.action`, `event.provider`, and `event.outcome` for a successful STS assume.
 41- Review `user.name`, `aws.cloudtrail.user_identity.arn`, role trust (`aws.cloudtrail.resources`, request parameters for
 42  `roleArn` / `roleSessionName`), and OIDC `sub` / `aud` if present in CloudTrail.
 43- Compare `source.ip`, `source.geo.*`, and `source.as.organization.name` to known cluster egress, NAT gateways, and
 44  approved operator networks.
 45- In Kubernetes: map the service account to workloads and audit activity around the event time (exec, secret access,
 46  new deployments).
 47
 48### False positive analysis
 49
 50- Egress through third-party security stacks or multi-cloud connectors can change how ASN organization is attributed.
 51- Expand exclusions for known `source.as.organization.name` values used by your egress path.
 52
 53### Response and remediation
 54
 55- If unauthorized: revoke the role session, rotate IRSA trust where appropriate, investigate token exposure, and reduce
 56  service account and role permissions.
 57
 58### Additional information
 59
 60- [AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html)
 61- [EKS IAM roles for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)
 62"""
 63references = [
 64    "https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html",
 65    "https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html",
 66]
 67risk_score = 73
 68rule_id = "ae32268b-bfd0-4c35-b002-13461b5830ca"
 69severity = "high"
 70tags = [
 71    "Domain: Cloud",
 72    "Domain: Identity",
 73    "Data Source: AWS",
 74    "Data Source: Amazon Web Services",
 75    "Data Source: AWS CloudTrail",
 76    "Use Case: Threat Detection",
 77    "Tactic: Initial Access",
 78    "Resources: Investigation Guide",
 79]
 80timestamp_override = "event.ingested"
 81type = "query"
 82
 83query = '''
 84data_stream.dataset:aws.cloudtrail and 
 85 event.provider:sts.amazonaws.com and 
 86 event.action:AssumeRoleWithWebIdentity and 
 87 event.outcome:success and user.name:(system\:serviceaccount\:* and not system\:serviceaccount\:kube-system\:aws-load-balancer-controller) and 
 88 source.as.organization.name:(* and not (Amazon* or AMAZON*))
 89'''
 90
 91[rule.investigation_fields]
 92field_names = [
 93    "@timestamp",
 94    "user.name",
 95    "user_agent.original",
 96    "source.ip",
 97    "source.geo.city_name",
 98    "source.geo.country_name",
 99    "source.as.organization.name",
100    "source.as.number",
101    "aws.cloudtrail.user_identity.arn",
102    "aws.cloudtrail.user_identity.type",
103    "aws.cloudtrail.user_identity.access_key_id",
104    "aws.cloudtrail.resources.arn",
105    "aws.cloudtrail.resources.type",
106    "event.action",
107    "event.outcome",
108    "cloud.account.id",
109    "cloud.region",
110]
111
112[[rule.threat]]
113framework = "MITRE ATT&CK"
114
115[[rule.threat.technique]]
116id = "T1078"
117name = "Valid Accounts"
118reference = "https://attack.mitre.org/techniques/T1078/"
119
120[[rule.threat.technique.subtechnique]]
121id = "T1078.004"
122name = "Cloud Accounts"
123reference = "https://attack.mitre.org/techniques/T1078/004/"
124
125[rule.threat.tactic]
126id = "TA0001"
127name = "Initial Access"
128reference = "https://attack.mitre.org/tactics/TA0001/"