EXPLORING AWS STS ASSUMEROOT

Summary from the TLDR InfoSec newsletter

AWS introduced the AssumeRoot API operation that allows for an IAM user in a management account of an organization to gain temporary credentials to the root user of a member account. The Elastic security team showcases how this privilege can be abused by an attacker to elevate compromised credentials in a management account to full compromise of a member account. The post includes Terraform code to setup the testing environment and detections to detect the attack.