Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Tactics
TA0003 TA0004

Sub-technique of
T1098


See: MITRE ATT&CK