# GuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principal

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/guardduty-suspicious-iam-activity-response

Recipe id: `guardduty-suspicious-iam-activity-response` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-IAM-SUS`
- control `ac-2.4`
- control `ac-2.13`
- control `ac-7`

## Collection

Kind: `cli`

```sh
# list-detectors
aws guardduty list-detectors --query 'DetectorIds[0]' --output text
# list-findings
aws guardduty list-findings --detector-id <DETECTOR_ID> --finding-criteria '{"Criterion":{"type":{"Eq":["UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS"]}}}'
# get-findings
aws guardduty get-findings --detector-id <DETECTOR_ID> --finding-ids <FINDING_ID>
# lookup-events-delete-login-profile
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteLoginProfile --max-results 10
```

## Expected output

GuardDuty finding detail (severity, affected IAM principal, timestamp) plus CloudTrail events (e.g. DeleteLoginProfile, DeleteAccessKey, DeactivateMFADevice, or PutUserPolicy attaching a deny) showing the account was disabled/secured after the finding

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

GuardDuty and CloudTrail are available in AWS GovCloud (US); principal ARNs use partition arn:aws-us-gov. Some IAM-focused GuardDuty finding types depend on CloudTrail management-event coverage

## Notes

Detection is pure telemetry; the response (which key/user to disable, whether it was malicious vs. authorized) requires incident-responder judgement, so this is partial. Evidence = finding + a linked responsive CloudTrail event within the IR SLA. cloudtrail lookup-events covers the last 90 days; use the finding type relevant to your workload.

## References

- {"title":"GuardDuty IAM finding types (including UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS)","url":"https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html"}
- {"title":"AWS CLI: guardduty list-findings","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/list-findings.html"}
- {"title":"AWS CLI: guardduty get-findings","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/get-findings.html"}
- {"title":"AWS CLI: cloudtrail lookup-events — the responsive action's record","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html"}