Monday,
February 03, 2025

🥖 Palette Cleanser

I have sad news, dear reader. And that is, there’s so much in the world to talk about that it distracts us from the real news, like AWS fixing a super duper extreme risk username enumeration issue. Instead of talking about how the AWS VPN client supporting concurrent connections, I must discuss DeepSeek.

There are different ways the internet catches on fire. Sometimes it's a vulnerability affecting millions of devices; other times, it's a breach exposing millions of data records. This week, it was tech bros enjoying a few too many puffs with finance bros and persuading the world that their leadership of the AI utopia was in doubt.

While newly minted experts flooded in, the Wiz research team stood out by actually providing expertise and data. They exposed trivially identifiable data leaks in DeepSeek, publishing screenshots showing DeepSeek playing fast and loose with privacy and security. That's my takeaway—everyone runs faster with a knife. In a race for trillions of dollars, security only becomes a priority after the winners are decided. Know the trade offs you are making.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • RogueOIDC: AWS Persistence and Evasion through attacker-controlled OIDC Identity Provider by Eduard Agavriloae

    You're probably already using OIDC magic to authenticate your Github or Terraform Cloud or whatever deployment pipelines into AWS. To make that magic happen, these platforms implement identity providers that you trust via IAM policies. Imagine one day your AWS account gets hacked and the attacker adds their own identity provider which they coded, and modifies the trust relationships you configured to trust their special identity provider. What would that look like, and how would it work? Eduard shows us and gives us the code.

  • AWS EKS Access Management & Permissions by Ashley Kingscote

    I've never worked with Kubernetes, and after reading this article, I continue to be happy with my life choices. Ashley explores a scenario in which 2 separate EKS clusters must work together in a secure least-privilege way. To do this, he reviews four separate options, each of which looks insanely complex on its own, and then he settles on using a combination of two. It's a great read, but only if you have a Kube kink.

  • AWS Resource Policy Quirks by Stephen Kuenzli

    IAM is weird. 80% of the time, it works the way it's 'supposed' to work. The other 27% of the time, you have to dig through the service documentation—only to realize there's still another 5% you haven't even considered. Surprisingly, this article is a light read, as Stephen breezes through a few quirky examples he's encountered.

Bonusii: Cloud Security predictions for 2025 and The Future of CSPMs

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Have you got a long list of AWS security issues you could fix but no idea how bad any of it really is?

Instead, start a free trial with Plerion. Focus on the 1% of risks that matter & achieve better security outcomes.

Simplify cloud security with Plerion.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS Security Bulletins

    No bulletins this week.

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.