New attack technique: New backdoor IAM role

[adanalvarez]

What does this PR do?

• New attack technique

This technique is just like aws.persistence.iam-backdoor-role but creating a role.

The difference here is that we do not update the assume role policy of the IAM role because we can include the assumeRolePolicyDocument when creating the role.

Doing it this way simulates the role creation just like what happened in the incident "The curious case of [email protected]"

Also, this allows us to test alerts that look for a CreateRole that contains an assumeRolePolicyDocument that allows access from accounts that we do not have in an allow list.

Motivation

Issue #469

Checklist

• The attack technique emulates a single attack step, not a full attack chain
• We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
• The attack technique makes no assumption about the state of the environment prior to warming it up