Control Tower Pivoting Using the Default Role

This report analyzes a pivot technique in AWS Control Tower where an attacker with access to the Management account can assume the AWSControlTowerExecution role in Member accounts due to Control Tower's default trust relationship and permissive resource statements; it details how to test for this condition, how to detect sts:AssumeRole attempts, and recommends defenses (permissions boundaries, tightening policies and Permission Sets) and remediation steps (in-line deny policies), while noting limitations such as Control Tower drift and session-duration behavior.