What is unauthorised cloud-resource abuse?¶

Unauthorised cloud-resource abuse is the creation or use of cloud services outside the account holder’s authority or purpose.

Evidential caution: that activity billed to a cloud account was performed by the legitimate account holder.

What this means¶

An offender may use compromised cloud access to create:

virtual machines;

containers;

serverless functions;

storage;

databases;

network services;

cryptomining workloads;

attack infrastructure.

which cloud account, tenant or subscription was used;

what identity or API key created the resource;

the source device and session;

resource type and region;

creation and deletion time;

cost;

network activity;

linked workloads;

whether the access was authorised.

Cloud activity may be automated.

One stolen key may create many resources without repeated human action.

Provider audit, identity, billing and resource records may be essential.

Unauthorised resources may be created in unfamiliar regions, projects or subscriptions to avoid attention. Compare creation with normal deployment patterns and preserve role changes, API calls, templates and automation that enabled the activity.

This can reveal the compromised identity or automation path. The operational takeaway is:

Trace cloud-resource creation from identity and session to workload and cost, and separate account ownership from the person or automation controlling it.

================================================================================

What to check or do next¶

• Investigators should establish:

Evidential limits¶

It may not have been.

Do not assume the person named on the billing account personally created or used them.

Cloud providers may suspend, throttle or automatically stop suspicious resources. Preserve the provider’s alert, enforcement action and reason. The absence of a running instance at examination does not prove that the workload never existed or that no cost was incurred.