Lesson 11 — AWS Persistence

Learning Objectives

By the end of this lesson, you will be able to:

• Understand persistence in AWS.
• Identify common cloud persistence techniques.
• Assess IAM persistence mechanisms.
• Review EC2, Lambda and Kubernetes persistence.
• Understand cross-account persistence.
• Detect persistence using AWS security services.
• Perform enterprise persistence assessments.

---

Introduction

After gaining privileged access, attackers rarely perform a single action and leave.

Instead, they attempt to maintain long-term access so they can return even if passwords are changed or vulnerabilities are patched.

This process is called Persistence.

Unlike traditional operating systems, AWS persistence primarily focuses on:

• IAM
• Temporary Credentials
• Cross-Account Trust
• Lambda
• EC2
• Kubernetes
• Cloud Automation
• Infrastructure as Code

Professional cloud penetration testers assess whether attackers could establish persistence without immediate detection.

---

Enterprise Scenario

CloudNova Technologies has completed an AWS penetration test for FinSecure Bank Ltd.

The assessment confirmed that an attacker successfully obtained administrator access through a misconfigured IAM role.

Management now wants to know:

• Could the attacker return later?
• How would they maintain access?
• Would the security team detect persistence?
• Which AWS services are most at risk?

Your task is to identify persistence opportunities and recommend controls to prevent them.

---

What is Persistence?

Persistence allows attackers to maintain access after the initial compromise.

Example:

Compromised IAM User

↓

Administrator Access

↓

Create New IAM User

↓

Create Access Keys

↓

Return Later

The attacker no longer depends on the original compromised account.

---

Enterprise Persistence Lifecycle

Initial Access

↓

Privilege Escalation

↓

Administrator Access

↓

Persistence

↓

Defense Evasion

↓

Lateral Movement

↓

Data Access

↓

Long-Term Control

Persistence often occurs immediately after privilege escalation.

---

Common AWS Persistence Targets

Attackers commonly target:

• IAM Users
• IAM Roles
• Access Keys
• Login Profiles
• Trust Policies
• Lambda Functions
• EC2 Instance Profiles
• CloudFormation
• EventBridge
• Kubernetes Service Accounts
• AWS Organizations

---

IAM User Persistence

Attackers may create new IAM users.

Example:

Administrator

↓

Create IAM User

↓

AdministratorAccess

↓

Create Access Keys

↓

Persistent Access

Review:

• Recently created users
• Administrator accounts
• Unused identities

---

Access Key Persistence

Creating additional access keys is one of the simplest persistence techniques.

Review permissions:

• iam:CreateAccessKey
• iam:UpdateAccessKey
• iam:DeleteAccessKey

CloudTrail should alert on unexpected access key creation.

---

Login Profile Persistence

An attacker may enable console access.

Example:

IAM User

↓

Create Login Profile

↓

Console Password

↓

Persistent Console Access

Review:

• iam:CreateLoginProfile
• iam:UpdateLoginProfile

---

IAM Role Persistence

Attackers may modify trust relationships.

Example:

Existing IAM Role

↓

Update Trust Policy

↓

External AWS Account

↓

Persistent AssumeRole Access

Review:

• Trust Policy changes
• Cross-account access
• Wildcard principals

---

IAM Policy Persistence

Persistence can also be established by attaching excessive permissions.

Example:

Administrator

↓

Attach Policy

↓

AdministratorAccess

↓

Future Access

Review:

• Attached Policies
• Inline Policies
• Policy Versions

---

Lambda Persistence

Attackers may modify Lambda functions to maintain access.

Examples:

• Scheduled execution
• Hidden API endpoints
• Malicious layers
• Additional IAM permissions

Review:

• Function configuration
• Execution role
• Event sources
• Deployment history

---

EventBridge Persistence

Attackers can create scheduled rules.

Example:

EventBridge

↓

Scheduled Lambda

↓

Credential Collection

↓

Amazon S3 Upload

Review:

aws events list-rules

Unexpected scheduled rules should be investigated.

---

EC2 Persistence

Persistence opportunities include:

• New SSH keys
• Startup scripts
• User Data modifications
• Additional IAM Roles
• Systems Manager access

Review:

• Instance metadata
• User Data
• Launch Templates
• Auto Scaling configuration

---

Kubernetes Persistence

Within Amazon EKS, attackers may create:

• ClusterRoles
• ClusterRoleBindings
• Service Accounts
• CronJobs
• DaemonSets
• Privileged Pods

Review:

kubectl get cronjobs -A

kubectl get clusterrolebindings

kubectl get serviceaccounts -A

Unexpected administrative objects may indicate persistence.

---

Cross-Account Persistence

Example:

Production Account

↓

Trust Policy

↓

External AWS Account

↓

AssumeRole

↓

Persistent Access

Review:

• External principals
• Shared administrator roles
• Trust conditions

---

CloudFormation Persistence

Infrastructure as Code can also be abused.

Attackers may:

• Deploy new IAM resources
• Create Lambda functions
• Modify networking
• Create administrator roles

Review:

aws cloudformation list-stacks

Verify all stack changes are authorized.

---

Enumeration Commands

List IAM users

aws iam list-users

---

List access keys

aws iam list-access-keys \
--user-name USERNAME

---

Review IAM role

aws iam get-role \
--role-name ROLE_NAME

---

List EventBridge rules

aws events list-rules

---

List Lambda functions

aws lambda list-functions

---

List CloudFormation stacks

aws cloudformation list-stacks

---

List Kubernetes CronJobs

kubectl get cronjobs -A

---

Enterprise Attack Path

Compromised IAM User

↓

Administrator Access

↓

Create Administrator IAM User

↓

Create Access Keys

↓

Modify Trust Policy

↓

Persistent Cross-Account Access

This attack path enables long-term unauthorized access even after the original credentials are revoked.

---

Enterprise Assessment Workflow

Review IAM

↓

Review Access Keys

↓

Review Login Profiles

↓

Review IAM Roles

↓

Review Trust Policies

↓

Review Lambda

↓

Review EventBridge

↓

Review EC2

↓

Review Kubernetes

↓

Review CloudFormation

↓

Identify Persistence

↓

Document Findings

---

Detecting Persistence

Enterprise defenders should monitor for:

• New IAM users
• New administrator roles
• Access key creation
• Login profile creation
• Trust policy changes
• Lambda modifications
• EventBridge rule creation
• CloudFormation deployments
• Kubernetes RBAC changes
• Service Account creation

CloudTrail, GuardDuty and Security Hub should generate alerts for unexpected administrative activity.

---

Common Enterprise Findings

Examples include:

• Unused administrator users
• Long-lived access keys
• Excessive trust relationships
• Shared IAM roles
• Scheduled Lambda functions
• Hidden EventBridge rules
• Administrator Kubernetes Service Accounts
• Unapproved CloudFormation stacks
• Multiple active administrator credentials
• Weak monitoring for IAM changes

---

Security Best Practices

• Enforce least privilege.
• Require MFA for all privileged identities.
• Rotate and remove unused access keys.
• Continuously monitor IAM changes.
• Restrict EventBridge rule creation.
• Protect Lambda execution roles.
• Audit CloudFormation deployments.
• Review Kubernetes RBAC regularly.
• Monitor cross-account trust relationships.
• Enable CloudTrail organization-wide.

---

Common Mistakes

Avoid:

• Ignoring newly created IAM users.
• Allowing permanent access keys.
• Sharing administrator roles.
• Leaving EventBridge rules unmanaged.
• Not reviewing CloudFormation changes.
• Using default Kubernetes Service Accounts.
• Failing to monitor IAM policy updates.

---

Knowledge Check

1. What is persistence in AWS?

Answer: Persistence is the ability for an attacker to maintain long-term access to an AWS environment after the initial compromise by creating or modifying identities, credentials or cloud resources.

---

2. Why are access keys commonly used for persistence?

Answer: Access keys provide programmatic access to AWS APIs and can remain valid for long periods if they are not rotated, monitored or removed.

---

3. Why should EventBridge rules be reviewed?

Answer: Attackers can create scheduled EventBridge rules to automatically invoke malicious Lambda functions or execute recurring tasks without manual intervention.

---

4. How can attackers establish persistence in Kubernetes?

Answer: Attackers may create privileged Service Accounts, ClusterRoleBindings, CronJobs or DaemonSets that continue operating even after the initial compromise has been addressed.

---

5. How can organizations detect AWS persistence techniques?

Answer: Organizations should monitor CloudTrail, GuardDuty, Security Hub and Kubernetes audit logs for unexpected IAM changes, new credentials, trust policy modifications and unauthorized infrastructure changes.

---

Key Takeaways

• Persistence is a critical post-compromise phase that allows attackers to maintain long-term access.
• IAM identities, access keys, trust relationships and automation services are common persistence mechanisms in AWS.
• Kubernetes, Lambda and CloudFormation can also be abused to establish persistent access.
• Continuous monitoring and regular identity reviews are essential for detecting persistence.
• Enterprise security teams should combine preventive controls with detective monitoring to quickly identify and remove unauthorized persistence mechanisms.

---

What’s Next?

In the next lesson, you will explore Lesson 12 — AWS Lateral Movement, where you will learn how attackers pivot between AWS services, accounts and Kubernetes environments using IAM roles, trust relationships and cloud-native techniques, and how to identify and prevent lateral movement during enterprise cloud security assessments.

➡️ Next Lesson: Lesson 12 — AWS Lateral Movement