AWS Security Digest · Issue #161

📋 Chef's selections

AWS CloudQuarry: Digging for Secrets in Public AMIs

What happens if you download 3.1 million public AMIs across 27 AWS regions and scan them for juicy secrets? Firstly, you probably burn a lot of time and money because that’s a lot storage and compute. In just under 10,000 compelling words Matei Josephs and Eduard Agavriloae explain how they did the work and what they found. If you are attracted to internet-scale scanning projects, this one is for you. Make sure to have a soft toy to cuddle. This one is scary.
The Universal Cloud Threat Model

A good threat model can help you quickly identify problem areas in a security model. A bad one can give you a false sense of security and make you want to watch paint dry instead. Chris Farris and Rich Mogull make this one useful because they don’t aim for completeness. Instead they cover the “90% of attacks experienced by 90% of organizations using the cloud” . I particularly enjoyed the ‘Why This Matters’ sections which help me feel a little less stupid.
Detecting AI resource-hijacking with Composite Alerts

If you can get past the magic-alerts-marketing, there are some really interesting details in this incident writeup from Lacework. The assertion is that the threat actor’s objective was “LLMjacking”, based on a variety of API calls made. They describe successful invocations of Ahtonropic Claude models, amongst many other IOCs that are worth reviewing.

Bonus: Gotcha: always use ARNs for S3 SSE-KMS - Aidan Steele explains why it’s important to always specify KMS keys as ARNs rather than aliases applying encryption to S3.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🧁 IAM permission changes

account: 3 new actions, 1 new condition - 3 new actions: AcceptPrimaryEmailUpdate (Grants permission to accept the process to update the prima
geo: 2 new actions | 1 updated action - 2 new actions: ForecastGeofenceEvents (Grants permission to forecast events for geofences stored in
redshift: 3 updated actions, 3 updated resources - 3 updated actions: CreateTags (resources), DeleteTags (resources), DescribeTags (resources); 3 updat
ssm: 2 updated actions - 2 updated actions: DescribeInstancePatchStates (resources, conditions), DescribeInstancePatches (res
networkmanager: 21 updated actions - 21 updated actions: AcceptAttachment (dependents), CreateConnectAttachment (dependents), CreateConne
launchwizard: 4 new actions, 1 new resource, 3 new conditions | 3 updated actions - 4 new actions: GetWorkloadDeploymentPattern (Grants permission to get a deployment pattern), ListTag
resiliencehub: 2 updated actions - 2 updated actions: CreateApp (dependents), UpdateApp (dependents)
lakeformation: 1 new action - 1 new action: GetDataLakePrincipal (Grants permission to retrieve the identity of the invoking princ
omics: 1 updated action - 1 updated action: StartRun (resources, dependents)
eks: 3 updated actions - 3 updated actions: CreateAddon (resources), DeleteAddon (resources), UpdateAddon (resources)
detective: 3 updated actions - 3 updated actions: AcceptInvitation (resources), DisassociateMembership (resources), RejectInvitatio
batch: 1 new action - 1 new action: GetJobQueueSnapshot (Grants permission to get a snapshot of an AWS Batch job queue in

🍪 API changes

AWS Audit Manager - 7 updated methods - New feature: common controls. When creating custom controls, you can now use pre-grouped AWS data sources based on common compliance themes. Also, the awsServices parameter is deprecated because we now manage services in scope for you. If used, the input is ignored and an empty list is returned.
AWS CodePipeline - 1 updated methods - CodePipeline now supports overriding S3 Source Object Key during StartPipelineExecution, as part of Source Overrides.
Amazon SageMaker Service - 2 updated methods - This release introduces a new optional parameter: InferenceAmiVersion, in ProductionVariant.
Amazon Verified Permissions - 4 updated methods - This release adds OpenIdConnect (OIDC) configuration support for IdentitySources, allowing for external IDPs to be used in authorization requests.
AWS Account - 3 new methods - This release adds 3 new APIs (AcceptPrimaryEmailUpdate, GetPrimaryEmail, and StartPrimaryEmailUpdate) used to centrally manage the root user email address of member accounts within an AWS organization.
Amazon Kinesis Firehose - 3 updated methods - Adds integration with Secrets Manager for Redshift, Splunk, HttpEndpoint, and Snowflake destinations
Amazon FSx - 18 updated methods - This release adds support to increase metadata performance on FSx for Lustre file systems beyond the default level provisioned when a file system is created. This can be done by specifying MetadataConfiguration during the creation of Persistent_2 file systems or by updating it on demand.
AWS Glue - 8 updated methods - This release adds support for creating and updating Glue Data Catalog Views.
AWS IoT Wireless - 1 updated methods - Adds support for wireless device to be in Conflict FUOTA Device Status due to a FUOTA Task, so it couldn't be attached to a new one.
Amazon Location Service - 2 new 4 updated methods - Added two new APIs, VerifyDevicePosition and ForecastGeofenceEvents. Added support for putting larger geofences up to 100,000 vertices with Geobuf fields.
AWS Storage Gateway - 2 updated methods - Adds SoftwareUpdatePreferences to DescribeMaintenanceStartTime and UpdateMaintenanceStartTime, a structure which contains AutomaticUpdatePolicy.
AWS Global Accelerator - 2 updated methods - This release contains a new optional ip-addresses input field for the update accelerator and update custom routing accelerator apis. This input enables consumers to replace IPv4 addresses on existing accelerators with addresses provided in the input.
AWS Glue - 4 updated methods - AWS Glue now supports native SaaS connectivity: Salesforce connector available now
Amazon Elastic Compute Cloud - 24 updated methods - U7i instances with up to 32 TiB of DDR5 memory and 896 vCPUs are now available. C7i-flex instances are launched and are lower-priced variants of the Amazon EC2 C7i instances that offer a baseline level of CPU performance with the ability to scale up to the full compute performance 95% of the time.
Amazon EventBridge Pipes - 3 updated methods - This release adds Timestream for LiveAnalytics as a supported target in EventBridge Pipes
Amazon SageMaker Service - 1 updated methods - Extend DescribeClusterNode response with private DNS hostname and IP address, and placement information about availability zone and availability zone ID.
Tax Settings - 7 new methods - Initial release of AWS Tax Settings API
AWS Batch - 1 new methods - This release adds support for the AWS Batch GetJobQueueSnapshot API operation.
Amazon Elastic Kubernetes Service - 19 updated methods - Adds support for EKS add-ons pod identity associations integration
AWS IoT TwinMaker - 2 updated methods - Support RESET_VALUE UpdateType for PropertyUpdates to reset property value to default or null

🍹 IAM managed policy changes

Managed Policy changed since last week: 10

🔀 Weekly diff

🤖 Powered by MAMIP | 🚩 Sensitive IAM Actions included

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

No CVE this week 🎉