AWS Security Digest

Monday,
January 13, 2025

🥖 Palette Cleanser

I have a confession. Last week I speculated that the source of a recent VW data exposure was an open S3 bucket. I was wrong and didn't do the work to get it right. This video from the Chaos Computer Club describes the root cause as an exposed vulnerable Java Spring application which allowed a heap dump to be searched for credentials. The discovered credentials could then be used to impersonate any user and export data from an API. This is still not good but obviously not as lolerskater as a public S3 bucket. Sorry for failing you and VW.

This week parts of the internet are once again being raided due to exploitation of critical vulnerabilities in two networky device thingies that are meant to protect us. Wiz has write ups for both the Aviatrix Controller and Ivanti Connect Secure appliances. Network devices have been getting wrecked lately, so now is a good time to evaluate which ones are truly necessary. My takeaway: you can put complexity behind fancy product marketing but it's still complexity once you peel away the label.

Stay safe out there friends.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

Introducing Policy Tester, a test harness for AWS IAM Policies by David Kerber

Even with the countless tools from AWS and others, creating IAM policies is hard. This tool feels like a meaningful step towards making it easier. Do your editing on the left, complete with all the linting goodies you'd expect, and test the actions you want to run on the right. David has created a short video demo to get you hyped.
How I automated Certificate expiration alerts with AWS by Tetiana Mostova

When something breaks it's always DNS unless it's failed certificate renewal. You can solve this problem many ways but I like Tetiana's simple setup for when you don't need other fancy functionality. A Lambda function, an EventBridge, an SNS topic, and you will never let a certificate expire accidentally again. It's definitely DNS.
Fast Unauthenticated Role Scanning by Ryan Gerstenkorn

Ryan is an avid bug bounty hunter so finding new attack surface and understanding target environments is critical to his success. There's a long standing approach to enumerating principals in a target AWS account without actually touching the account, using resource policies. It was really slow until QuietcRiot made it fast. Ryan has managed to ~10x the speed again for those willing to take chances with the AWS ban hammer.

🥖 Palette Cleanser

📋 Chef's selections

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🤖 Dessert

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS Security Bulletins