---
title: AWS IAM Long-Term Access Key First Seen from Source IP
description: Identifies the first time, within the configured history window, that a long-term IAM access key ID (prefix AKIA) is used successfully from a given source.ip...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_iam_long_term_access_key_first_seen_from_source_ip
products:
  - Elastic Security
---

# AWS IAM Long-Term Access Key First Seen from Source IP
Identifies the first time, within the configured history window, that a long-term IAM access key ID (prefix AKIA) is
used successfully from a given source.ip in AWS CloudTrail. Long-term access keys belong to IAM users or the account
root user. They are a common target after credential theft or leakage, including supply-chain and exposed-key scenarios.
Temporary security credentials (prefix ASIA) and console sessions are excluded so the signal emphasizes programmatic
access patterns.
**Rule type**: new_terms
**Rule indices**:
- logs-aws.cloudtrail-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-6m`
**Maximum alerts per execution**: 100
**References**:
- [[https://kudelskisecurity.com/research/investigating-two-variants-of-the-trivy-supply-chain-compromise](https://kudelskisecurity.com/research/investigating-two-variants-of-the-trivy-supply-chain-compromise)](https://kudelskisecurity.com/research/investigating-two-variants-of-the-trivy-supply-chain-compromise)

**Tags**:
- Domain: Cloud
- Data Source: AWS
- Data Source: Amazon Web Services
- Data Source: AWS CloudTrail
- Data Source: AWS IAM
- Use Case: Threat Detection
- Tactic: Credential Access
- Tactic: Initial Access
- Resources: Investigation Guide

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating AWS IAM Long-Term Access Key First Seen from Source IP

This rule is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) detection on CloudTrail. It fires when a successful API call uses a long-term IAM access key (`AKIA*`) from a `source.ip` that has not appeared with that key in the rule history window.
Long-term keys are high-value targets. Unlike session credentials (`ASIA*`), they do not expire until rotated or deleted. Threat reporting on cloud compromises often highlights abuse of leaked or stolen `AKIA` keys.

### Possible investigation steps

**Confirm the key and principal**
- Identify the IAM user or root context implied by `aws.cloudtrail.user_identity.arn` or `user.name`.
- **`aws.cloudtrail.user_identity.type`**: Distinguish `IAMUser`, `Root`, or other types; root long-term keys warrant extra scrutiny.

**Assess the new source**
- **`source.ip`** and **`source.geo`**: Compare to normal geography, corporate egress, and known cloud provider ranges.
- **`user_agent.original`**: Identify AWS CLI, SDKs, custom tooling, or unusual agents.

**Correlate activity**
- Search CloudTrail for the same access key and IP over the following hours for sensitive APIs (IAM changes, STS, S3 data access, Secrets Manager, role assumption).
- Review IAM last-used metadata for the key in the AWS console or API (`GetAccessKeyLastUsed`).


### False positive analysis

- Travel and VP* for human IAM users.
- New CI runners, ephemeral build agents, or re-IP'd NAT gateways for automation keys.
- Partner or MSP access from new networks if keys are shared (discouraged practice).


### Response and remediation

- If unexpected, deactivate or delete the access key, rotate credentials, and review policies attached to the user.
- Enable or enforce MFA for console users; prefer roles and temporary credentials over long-term keys for workloads.
- Document approved networks or principals and tune history or exceptions accordingly.


### Additional information

- [AWS Security Incident Response Guide](https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/aws-security-incident-response-guide.pdf)


## Rule Query

```kuery
event.dataset: "aws.cloudtrail"
    and event.outcome: "success"
    and source.ip:*
    and aws.cloudtrail.user_identity.access_key_id: AKIA*
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Credential Access
- Id: TA0006
- Reference URL: [[https://attack.mitre.org/tactics/TA0006/](https://attack.mitre.org/tactics/TA0006/)](https://attack.mitre.org/tactics/TA0006/)
- Technique:
  - Name: Unsecured Credentials
- Id: T1552
- Reference URL: [[https://attack.mitre.org/techniques/T1552/](https://attack.mitre.org/techniques/T1552/)](https://attack.mitre.org/techniques/T1552/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Initial Access
- Id: TA0001
- Reference URL: [[https://attack.mitre.org/tactics/TA0001/](https://attack.mitre.org/tactics/TA0001/)](https://attack.mitre.org/tactics/TA0001/)
- Technique:
  - Name: Valid Accounts
- Id: T1078
- Reference URL: [[https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/)](https://attack.mitre.org/techniques/T1078/)
- Sub Technique:
  - Name: Cloud Accounts
- Id: T1078.004
- Reference URL: [[https://attack.mitre.org/techniques/T1078/004/](https://attack.mitre.org/techniques/T1078/004/)](https://attack.mitre.org/techniques/T1078/004/)