Executive Summary
In May 2026, the AWS Customer Incident Response Team (CIRT) identified a tactic where threat actors, upon gaining control of a customer's AWS account, remove it from the AWS Organizations structure. This action bypasses Service Control Policies (SCPs) and other governance controls, leading to potential security risks and loss of centralized management. The attackers exploit permissions like organizations:LeaveOrganization to execute this maneuver, resulting in the account operating independently without the protective measures enforced by the organization.
This incident underscores the importance of implementing strict IAM policies and SCPs to prevent unauthorized account removals. Organizations should regularly audit permissions, enforce the principle of least privilege, and monitor CloudTrail logs for organizations:LeaveOrganization API calls to detect and mitigate such threats promptly.
Why This Matters Now
The increasing sophistication of threat actors in exploiting cloud governance structures necessitates immediate attention to IAM configurations and organizational policies to prevent unauthorized account removals and maintain security integrity.
Attack Path Analysis
An attacker gains access to an AWS account using compromised credentials, escalates privileges to obtain the organizations:LeaveOrganization permission, removes the account from AWS Organizations to bypass security controls, establishes command and control channels, exfiltrates data, and causes impact by disrupting services or deleting resources.
Kill Chain Progression
Initial Compromise
Description
The attacker gains access to the AWS account using compromised credentials.
MITRE ATT&CK® Techniques
Valid Accounts: Domain Accounts
Account Manipulation
Impair Defenses: Disable Cloud Logs
Valid Accounts: Cloud Accounts
Leave AWS Organization
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Restrict access to system components and cardholder data
Control ID: 7.2.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity Governance and Administration
Control ID: Pillar 1: Identity
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Critical exposure to AWS Organizations removal attacks threatens regulatory compliance, zero trust segmentation, and encrypted traffic controls essential for financial data protection.
Health Care / Life Sciences
HIPAA compliance violations from cloud misconfiguration attacks bypassing organizational controls, compromising patient data protection through unauthorized account removals and policy evasion.
Government Administration
High-value targets for threat actors seeking to bypass service control policies and organizational security controls protecting sensitive government systems and data.
Information Technology/IT
Multi-cloud visibility loss and compromised zero trust architectures when AWS accounts are removed from organizations, impacting client security postures and operations.
Sources
- CIRT insights: How to help prevent unauthorized account removals from AWS Organizationshttps://aws.amazon.com/blogs/security/cirt-insights-how-to-help-prevent-unauthorized-account-removals-from-aws-organizations/Verified
- Essential security controls to prevent unauthorized account removal in AWS Organizationshttps://aws.amazon.com/blogs/mt/essential-security-controls-to-prevent-unauthorized-account-removal-in-aws-organizations/Verified
- RemoveAccountFromOrganization - AWS Organizationshttps://docs.aws.amazon.com/organizations/latest/APIReference/API_RemoveAccountFromOrganization.htmlVerified
- LeaveOrganization - AWS Organizationshttps://docs.aws.amazon.com/organizations/latest/APIReference/API_LeaveOrganization.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Implementing Aviatrix Zero Trust CNSF could have significantly constrained the attacker's ability to escalate privileges, move laterally, and exfiltrate data within the AWS environment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While Aviatrix CNSF may not prevent initial credential compromise, it could limit the attacker's ability to exploit these credentials by enforcing strict access controls and monitoring.
Control: Zero Trust Segmentation
Mitigation: Aviatrix Zero Trust Segmentation could likely limit the attacker's ability to escalate privileges by enforcing strict access controls and segmenting network access.
Control: East-West Traffic Security
Mitigation: Aviatrix East-West Traffic Security could likely constrain the attacker's lateral movement by monitoring and controlling internal traffic flows.
Control: Multicloud Visibility & Control
Mitigation: Aviatrix Multicloud Visibility & Control could likely detect and limit unauthorized command and control channels by providing comprehensive monitoring across cloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: Aviatrix Egress Security & Policy Enforcement could likely prevent data exfiltration by controlling and monitoring outbound traffic.
While Aviatrix CNSF may not fully prevent service disruption or resource deletion, it could likely limit the scope of impact by enforcing segmentation and access controls.
Impact at a Glance
Affected Business Functions
- Cloud Resource Management
- Security Monitoring
- Billing and Cost Management
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of sensitive cloud configurations and access credentials.
Recommended Actions
Key Takeaways & Next Steps
- • Implement a Service Control Policy (SCP) that denies the organizations:LeaveOrganization action to prevent unauthorized account removal.
- • Enforce the principle of least privilege by limiting permissions to only those necessary for each role.
- • Enable multi-factor authentication (MFA) on all accounts to add an additional layer of security.
- • Regularly review IAM policies and permissions to identify and remediate overly permissive configurations.
- • Monitor CloudTrail logs for organizations:AcceptHandshake and organizations:LeaveOrganization API calls to detect unauthorized account removal attempts.
