cross-account iam roles

Qubole Breach Turned Vendor AWS Trust Into a Skeleton Key

Attackers used Qubole's own IAM credentials to assume roles in dozens of customer AWS accounts, stealing secrets and S3 data over 12 days.