Monday,
June 10, 2024

🎉 AWS Security Digest is changing chefs

After 3+ years and over 160 issues Victor Grenu is taking off the chef’s hat to pursue new creative endeavours. It’s been an incredible run and he is keen to keep the community growing and thriving.

Luckily, Victor and I found each other at the right time. I am excited to announce that I will be your new chef, continuing Victor’s legacy. My name is Daniel Grzelak, and I’m the Chief Innovation Officer at cloud security company, Plerion. More than that, I live and breathe AWS security. I’ve been hacking AWS and talking about it since 2016.

I’m unreasonably excited for where we can take the ASD community together. Speaking of which, now is the perfect time to send me (editor@awssecuritydigest.com) your feedback and ideas. Let me know how we can make it even better going forward.

❤️ DG

🔗 Victor’s announcement. 🔗 Plerion’s announcement.

🎤 It’s AWS security conference season

Everyone's favorite time of year is here. AWS re:Inforce and fwd:cloudsec North America are running back to back, this week and next. I’ll do my best to summarize the most important announcements and content in the next couple of issues so you don’t miss a thing.

I’ll be attending fwd:cloudsec in Arlington in person. Please find me and say hi. I’d love to hear about your experiences with ASD.

📋 Chef's weekly selections

  1. AWS CloudQuarry: Digging for Secrets in Public AMIs

    What happens if you download 3.1 million public AMIs across 27 AWS regions and scan them for juicy secrets? Firstly, you probably burn a lot of time and money because that’s a lot storage and compute. In just under 10,000 compelling words Matei Josephs and Eduard Agavriloae explain how they did the work and what they found. If you are attracted to internet-scale scanning projects, this one is for you. Make sure to have a soft toy to cuddle. This one is scary.

  2. The Universal Cloud Threat Model

    A good threat model can help you quickly identify problem areas in a security model. A bad one can give you a false sense of security and make you want to watch paint dry instead. Chris Farris and Rich Mogull make this one useful because they don’t aim for completeness. Instead they cover the “90% of attacks experienced by 90% of organizations using the cloud” . I particularly enjoyed the ‘Why This Matters’ sections which help me feel a little less stupid.

  3. Detecting AI resource-hijacking with Composite Alerts

    If you can get past the magic-alerts-marketing, there are some really interesting details in this incident writeup from Lacework. The assertion is that the threat actor’s objective was “LLMjacking”, based on a variety of API calls made. They describe successful invocations of Ahtonropic Claude models, amongst many other IOCs that are worth reviewing.

Bonus: Gotcha: always use ARNs for S3 SSE-KMS - Aidan Steele explains why it’s important to always specify KMS keys as ARNs rather than aliases applying encryption to S3.

🥗 AWS security blog

🍹 Updated AWS managed IAM policies

Managed Policy changed since last week: 10
  1. AWSOrganizationsReadOnlyAccess
  2. 🚩 AWSProtonDeveloperAccess
  3. 🚩 AWSProtonFullAccess
  4. 🚩 AmazonDataZoneGlueManageAccessRolePolicy
  5. 🚩 AmazonSageMakerModelGovernanceUseAccess
  6. 🚩 AmazonSageMakerModelRegistryFullAccess
  7. AmazonTimestreamReadOnlyAccess
  8. 🚩 CloudWatchApplicationSignalsFullAccess
  9. 🚩 CloudWatchApplicationSignalsReadOnlyAccess
  10. WAFV2LoggingServiceRolePolicy

🔀 Weekly diff

🤖 Powered by MAMIP | 🚩 Sensitive IAM Actions included

🧁 IAM permission changes

🍔 AWS API Changes

☕︎ CloudFormation updates

🍪 Amazon Linux CVEs

No CVE this week 🎉

👾 r/aws

Crafted with ❤️ by Plerion. We simplify cloud security.