# AWS Console Session Traceability: How Attackers Obfuscate Identity Through the AWS Console

AWS console sessions under assumed roles log a different temporary access key than the AssumeRole event, breaking CloudTrail attribution of attacker actions.

- Payout: Research
- Severity: medium
- Program: AWS
- Write-up by: Wiz Research
- Disclosed: 2024-08-22
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/aws-console-session-traceability-how-attackers-obfuscate-identity-through-aws-console
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-aws-console-session-traceability-how-attackers-obfuscate-identity-through-aws-console
- Tags: area:cloud domain:cloud impact:integrity kind:research platform:threat-intel sev:medium tech:aws technique:source-review vuln:info-disclosure

**Target:** AWS CloudTrail / STS AssumeRole / federated console sessions
**Root cause:** When a console session is initiated under an assumed role, every action executed through the console is logged in CloudTrail with a temporary access key different from the one in the corresponding AssumeRole event, because AWS derives the key from the original request.
**Steps:**
1. Attacker obtains permanent access key of IAM user Alice with sts:AssumeRole permission.
2. `aws sts assume-role --role-arn arn:aws:iam::121175308212:role/DevelopersRole --role-session-name bobB@techwave.com` to shift blame to Bob.
3. Before any further action, create a federated console session from the assumed role (converts CLI session to console session).
4. Perform malicious actions via the AWS Console; CloudTrail logs them with a temporary access key that does not match the AssumeRole responseElements key.
5. Investigator cannot link console events to the AssumeRole event via access key id, losing the breadcrumb to Alice's credentials.
**How found:** Researchers noticed that CLI/SDK actions allow linking temporary keys to AssumeRole responseElements, but console actions under assumed roles produce a mismatched key, breaking the standard traceability chain.
**Exploitation:** With a stolen permanent access key, assume a role using a misleading role session name, then mint a federated console session and operate through the console so logged access keys no longer match the AssumeRole event, concealing the origin principal.
**Insight:** Federated console sessions mint a new access key distinct from the AssumeRole responseElements key; to re-link them, correlate principalId suffix to roleSessionName, userName to roleName, and sessionContext creationDate to AssumeRole eventTime (within ~1s), especially against consoleLogin events with external IPs.

## Proof of concept (copied exactly from the original report)

**AssumeRole with spoofed session name bobB**

```
aws sts assume-role --role-arnarn:aws:iam::121175308212:role/DevelopersRole --role-
session-name bobB@techwave.com
```