AWS Security Digest

Monday,
November 25, 2024

🥖 Palette Cleanser

Hello again loyal diners. Thank you, Cynthia Cheung, for putting together last week's issues while I was celebrating my n+1 wedding anniversary. I can confirm I am not divorced and ASD will continue as planned!

The pre:invent announcements have been coming thick and fast and they aren't all AI related. John Misczak wrote a deeper summary but here's what you need to know:

Root account management in Organizations - Instead of dealing with root creds in every account, AssumeRoot.
VPC Block Public Access - If you like how this works in S3, you might like it in VPCs too. There's some finer-grained control that makes the VPC version more flexible but also more complicated.
Cognito overhaul - Lots of quality of life improvements but my favourite part is support for passwordless login, including passkey authentication.
Improved SSM experience - The sneaky best change is the ability to identify all unmanaged nodes.
Resource Control Policies (mentioned last week) - Check out Jason Kao's guide on how to apply them to KMS.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

Stop Using Predictable Bucket Names by Jonathan Walker

Johnnie Dub has been playing with AWS docs lately and turned that into finding all the S3 buckets that AWS creates by default. It's kind of like the shadow resources research but targeting AWS itself. Nothing too serious, but he was able to identify some open buckets and patterns that might be useful to hackers.
How Lambda Misconfigurations Can Lead to Lateral Movement by Yehonatan Bitton

There's nothing new here but I like it because it demonstrates how a Lambda attack could work in practice. It's like an attack path walkthrough - Yehonatan makes up a Shop application and shows all the steps needed to hack it.
Confused Deputy Vulnerability in Amazon DataZone by Carlos Mora

Carlos found a way to get the DataZone service to assume role into other people's accounts. AWS quickly fixed the issue, but it's still a cool example of a bug type that keeps popping up over and over.

🥖 Palette Cleanser

📋 Chef's selections

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🤖 Dessert

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS Security Bulletins