AWS IAM resource group deletion

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Account Access Removal (T1531)
Severity	Informational

Description

An AWS IAM resource group was deleted, this action may affect the permissions of the members of the deleted group.

Attacker's Goals

An attacker may interrupt the availability of an account, this may revoke access to the account.

Investigative actions

• Check what members were affected by this action.