🥖 Palette Cleanser

Cloud security is back to normal. I know this because my 70 year old mother has not called me this week to explain how my friends broke everything. Yay! There was some great gossip nonetheless, as Wiz apparently walked away from a $23 billion acquisition offer from Alphabet.

If you are headed to Defcon this year, the Cloud Village has some exceptional talks scheduled August 9-11.

Have feedback about AWS Security Digest? Tell us here.

📋 Chef's selections

• Revealing the Inner Structure of AWS Session Tokens by Tal Be'ery

  This is a spectacular piece of reverse engineering of AWS session tokens by Tal Be'ery. Tal details the fascinating research process start to finish for how he identified and decoded each field. Although there was ultimately no negative security impact, the post includes source code and a tool to inspect and modify tokens, leaving the door open for further exploration.

• Enabling Security Guardrails: Infra as Code with CDK for Terraform by Ashish Patel and Victor Chen

  We can't all be riveting reverse engineers and hilarious hackers. There are folks out there securing things, like the expert engineers at Zip, who migrated to infrastructure-as-code using Terraform CDK (Terraform Cloud Development Kit) with Python. My favourite bit is how they used tags and service control policies to "disable" ClickOps along the way.

• NO_WILDCARD: How I discovered the Organization ID of any AWS Account by Sam Cox

  Want to get anyone's OrgId? This is a new addition to a long chain of research that started with getting the account ID of a public S3 bucket, then even a private bucket, then various metadata from many public resources. Again not much security impact but very cool to see research compounding over time.

Bonus: For those that like decoding things but without cool decoder rings, Aidan W Steele (the W is for Winning) gives us a decoder for turning AWS unique IDs into ARNs.

🥗 AWS security blogs

• Overseeing AI Risk in a Rapidly Changing Landscape by Mark Schwartz
• Hardening DNS Resolution for Amazon WorkSpaces Personal by Nahuel Benavidez
• Govern Microsoft workloads using the myApplications dashboard on AWS by Mangesh Budkule
• Streamlining digital transformation in German healthcare with AWS by Geraldine Reichard
• How AWS Wickr can enable secure communications for the Australian Government and its allies by Andrew McBride
• Responsible AI for mission-based organizations by Mike George
• Leverage AWS Training to enable your workforce to achieve digital transformation by Saurabh Sharma

🍛 Reddit threads on r/aws

• Automate resource access based on IP
• Security - sending clients’ data outside AWS infrastructure to OpenAI API?
• Experiences working as an actual maintenance technician for an AWS site?
• AWS Control Tower
• AWS Security program

🧁 IAM permission changes

elasticloadbalancingv2, gamelift, cleanrooms, ssm, ecr, entityresolution, workmail, cleanrooms, cloudtrail, eks, quicksight, resource-explorer-2, connect

🍪 API changes

AWS Clean Rooms Service, AWS IoT SiteWise, AWS Elemental MediaPackage v2, AWS Health Imaging, AWS Clean Rooms Service, AWS Clean Rooms ML, Amazon Connect Service, Amazon Connect Contact Lens, AWS EntityResolution, Amazon Connect Service, Amazon Elastic Compute Cloud, Amazon Kinesis Firehose, AWS Elemental MediaLive, Amazon SageMaker Service, Amazon DataZone, Redshift Serverless

🍹 IAM managed policy changes

AmazonSageMakerCanvasEMRServerlessExecutionRolePolicy, AmazonOpenSearchServerlessServiceRolePolicy, AWSMarketplaceSellerFullAccess, CloudwatchApplicationInsightsServiceLinkedRolePolicy, AmazonDMSVPCManagementRole, AWSResilienceHubAsssessmentExecutionPolicy, AWSBackupOperatorAccess, AmazonSageMakerNotebooksServiceRolePolicy, AmazonConnectSynchronizationServiceRolePolicy, AmazonSageMakerNotebooksServiceRolePolicy, FMSServiceRolePolicy, AWSDataSyncFullAccess, AWSElementalMediaLiveReadOnly, AWSDataExchangeReadOnly

☕ CloudFormation resource changes

AWS::CleanRooms::ConfiguredTable, AWS::CleanRooms::ConfiguredTableAssociation, AWS::EntityResolution::MatchingWorkflow, AWS::EntityResolution::SchemaMapping, AWS::CleanRooms::IDMappingTable, AWS::CleanRooms::IdNamespaceAssociation, AWS::WorkSpacesWeb::UserSettings

🎮 Amazon Linux vulnerabilities

CVE-2024-41091, CVE-2024-41090, CVE-2024-41110, CVE-2024-6197, CVE-2024-1975, CVE-2024-4076, CVE-2024-1737