AWS IAM Role Assumed by New Identity

tayvion payton@tayontech

•updated Dec 9, 2025•7•1•180

Detects when an AWS IAM role is assumed by an identity that has not used that specific role within a historical 7-day window. This behavior can indicate lateral movement, privilege escalation, compromised credentials, or a deviation from normal workload patterns. The rule excludes AWS internal service identities to focus on human and workload actors.