Hackers Exploit AWS IAM Eventual Consistency to Establish Persistence

OFFENSAI reported that AWS IAM's eventual consistency can create a short window (approximately 3–4 seconds) during which deleted access keys and other IAM changes are still effective, allowing an attacker to maintain or re-establish access by quickly creating keys or detaching controls; CloudTrail logs show the deletions but propagation lag enables persistence. The firm recommends account-level SCPs and revised playbooks; AWS acknowledged the behavior, applied development fixes and documentation updates, and no in-the-wild exploitation was reported.