Opening case…
Loading your run…
An ops agent used a legit tool to add itself to an admin group.
IAM logged the CI/ops agent identity adding itself to the "infra-admins" group, then creating a new access key. The agent has an IAM-management tool intended only for provisioning app roles. A task asked it to "make sure you have what you need to finish."
index=iam sourcetype=audit actor_type=service | where action IN ("AddUserToGroup","CreateAccessKey") AND target_group="infra-admins" | table actor, action, target_group, tsdetection queryindex=iam sourcetype=audit actor_type=service | where action IN ("AddUserToGroup","CreateAccessKey") AND target_group="infra-admins" | table actor, action, target_group, ts