LoFP LoFP / automated monitoring tools or compliance audit scripts using long-term iam keys to inventory backup coverage will trigger this rule. migrate automation to iam roles with short-lived credentials. long-term key usage for backup management is a security anti-pattern.

Techniques

Sample rules

AWS Backup Resource Enumeration via Long-Term Access Key

Description

Detects enumeration of AWS Backup resources using long-term IAM access keys (AKIA* prefix). AWS Backup protects EC2 instances, EBS volumes, RDS databases, DynamoDB tables, EFS file systems, and S3 buckets. An adversary who obtains long-term access keys may enumerate backup vaults, backup plans, and protected resources as a precursor to ransomware. Identifying which resources have recent backups (indicating high-value data) and what vault access policies can be modified to delete or corrupt the backups before encrypting the primary data.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "backup.amazonaws.com"
    and event.action: (
        "ListBackupVaults" or
        "ListBackupJobs" or
        "ListBackupPlans" or
        "ListProtectedResources" or
        "ListRecoveryPointsByBackupVault" or
        "GetBackupPlan" or
        "GetBackupVaultAccessPolicy" or
        "DescribeBackupJob" or
        "DescribeRecoveryPoint"
    )
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.access_key_id: AKIA*