Scenario 3: IAM Role Credential Exfiltration
Unlike the previous two scenarios where everything was automatically simulated by CloudFormation, in this section, you will actively participate in simulating the attack and investigating the incident. This hands-on exercise will consist of two main phases:
Generate Findings Manually: Acting as an attacker, you will access the EC2 instance via Session Manager to steal temporary credentials (IAM Role credentials). Then, you will exfiltrate this information to your personal computer to make API calls in order to probe and illegally manipulate services like IAM, DynamoDB, and SSM. This action will trigger an alert from GuardDuty.
Investigation and Remediation (Credential Exfiltration): After the alert (Finding) is generated, you will return to your administrator role to review the High Severity finding in GuardDuty. Finally, you will examine how EventBridge and Lambda automatically react (Remediation) to isolate the threat and verify whether the automated permission revocation (RevokeOldSessions) was successful.