Why did I receive an Amazon GuardDuty finding type UnauthorizedAccess:IAMUser/TorIPCaller or Recon:IAMUser/TorIPCaller alerts for my IAM user or role?

Last updated: 2020-02-19

Amazon GuardDuty detected alerts for the UnauthorizedAccess:IAMUser/TorIPCaller or Recon:IAMUser/TorIPCaller finding types.

Short Description

The UnauthorizedAccess:IAMUser/TorIPCaller and Recon:IAMUser/TorIPCaller finding types indicate that your AWS Identity and Access Management (IAM) identity credentials or access keys were used to make an API operation to AWS from a Tor exit node IP address. For example, you can get this error when trying to create an EC2 instance, list access key IDs, or modify IAM permissions. These finding types can also indicate that IAM identity credentials or access keys are compromised. For more information, see An API was invoked from a Tor exit node IP address.

Resolution

Use GuardDuty to locate the IAM access key, and AWS CloudTrail to identify the AWS API activity.

  1. Follow the instructions to view and analyze your GuardDuty findings.
  2. In the findings detail pane, note the IAM access key ID.
  3. Follow the instructions to search for IAM access key API activity using CloudTrail.
  4. Follow the instructions for remediating compromised AWS credentials.
  5. If you confirm that the activity is not a legitimate use of AWS credentials, see My AWS account might be compromised.

Did this article help you?

Anything we could improve?


Need more help?