AWS Security Digest

Monday,
January 27, 2025

🥖 Palette Cleanser

There's no brouhaha this week so instead let's talk about to a tool you probably should be using (more), awscurl. It does what it sounds like it does, with the bonus of magically signing requests with AWS Signature Version 4. If you do any sort of AWS security testing or research, this can be a huge time saver. Give it a go and let me know your favorite use case.

It was Australian Day yesterday. To celebrate, here is a video of the most Australian man ever. His name is also Daniel - coincidence?

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

Ransomware in AWS S3: SSE-C by Jason Kao

Last week's issue linked to a lot of resources related to recent S3 ransomware incident(s?). Jason implies the Halcyon and Amazon write-ups are one and the same, and draws some conclusions about initial access, recon, and impact. But what makes the article worth reading is the resource control policy you (and everyone) can (and should) immediately apply at the org level unless you have some specific need for SSE-C. Maybe AWS should roll this policy into default org creation?
Plaid's journey to creating a key management system by Shuaiwei Cui and Anirudh Veeraragavan

There are special kinds of engineers out there who both enjoy hurting themselves and have a genuine need to build their own cryptographic solutions. In this case Plaid (believed they) needed cost-efficiency and scale that commercial solutions couldn't provide. Presumably there was a fire walking ceremony, after which they actually built their own KMS, and then described it at a reasonably high-level in this blog post. Perhaps most telling is the lesson they learned: "Ownership is ongoing". Maybe I'm projecting my own painful experiences though?
Datadog threat roundup: top insights for Q4 2024 by Matt Muir, Andy Giron, Adrian Korn, Greg Foss, and Oren Margalit.

Who doesn't love a good canine threat roundup? Since we've covered most of their AWS threat research posts in the past, the most noteworthy topic is the emergence of a number of actors targeting npm and PyPi consumers.

Bonusii: How to create an EC2 WebServer with SSRF to try AWS iMDSv1 exploit and Own (or PWN) the Org with CloudFormation StackSets

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes