Monday,
April 07, 2025

🥖 Palette Cleanser

Hello friend,

Isn't it great to be poorer reading this issue than we were reading the last one? The timing of that Wiz acquisition looks perfect right about now.

There's good timing (Wiz), and then there's bad timing (Oracle). I held back previously from mentioning news of a potential Oracle Cloud breach but according to Bloomberg, Oracle is now privately confirming to customers that some of its "legacy" cloud systems have been breached. Oracle had previously categorically denied the breach to SecurityWeek. And that dear reader, is why incident response requires time and thorough investigation. Breaches happen. It's how we deal with them that shows our trustworthiness.

Today's issue is heavy on general cloud content. It's all still awesome and worthy of your time. It applies to AWS, but it also happens to apply equally to GCP and Azure. Enjoy!

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • Invoking Misconfigured API Gateways from Any External AWS Accounts by Eduard Agavriloae

    Sometimes the words we use in naming things matter more than we expect. In this post, Eduard points out that REST "private" API Gateways are not private in the sense that they can't be invoked from outside your AWS account. They're private in the sense that they can't be invoked outside the AWS network. It's a little bit like that 'Authenticated Users' group S3 has, where most sane people assumed it restricted access to authenticated users in their own account, but it actually means anyone authenticated to any AWS account. Eduard rightly points out that API Gateway IDs are hard to guess, but Awseye says hello.

  • Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on IAM, Exfiltration by Nathaniel Quist

    As Kat Traxler has pointed out, we need to consume cloud trend reports with a grain of salt. That's true here too, since it relies on data from Palo's slice of internet visibility. However, Nathaniel doesn't just lean on big stats like "116% rise in impossible travel alerts relating to cloud identities" to carry the report. He describes important alerts we should all implement and connects them to real-world threat actor activity.

  • IaC Ownership — Tag-based Approach by Dan Abramov

    If you want to operationalize automation in AWS or any other cloud, you need to be able to send work to the right place. Unless you're running a tiny environment, that's not as easy as it sounds. This article explores how Dan scraped together tooling to get Terraform to auto-tag identities with information about what and who created them. I'd love to see Dan publish the code he used, but it's still interesting as a guide to one viable approach to attribution.

Bonusii:

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Plerion is building an AI cloud security engineer that works like another member of your team.

Want to be a design partner? Let's do it together!

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

    No new CVEs.

📺 AWS Security Bulletins

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.