Monday,
June 02, 2025

🥖 Palette Cleanser

Was it a quiet week, or was it just quiet in Bali?

If you also happen to have some quiet time, consider submitting to the fwd:cloudsec Europe CFP. It's an awesome conference, and they want talks from any practitioner who is responsible for securing a cloud service or service provider.

Have a wonderful week, my lovelies.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • CloudTrail Logging Evasion: Where Policy Size Matters by Abian Morina

    Simple hacking is the best hacking. What happens if you stick a lot of whitespace in a request to the AWS API? Sometimes maybe good things, sometimes maybe bad things. Abian provides precision about how whitespace is treated in IAM policies and how much whitespace is required to drop a policy from CloudTrail in an iam:CreatePolicy API call. This issue won't be fixed for some time, so it's worth being on the lookout for "requestParameters too large" in CloudTrail.

  • Storm-0558 and the Dangers of Cross-Tenant Token Forgery by Damian Archer

    Damian analyzed the token abuse tactics used by Storm-0558 to forge tokens to access Microsoft OWA and Outlook.com. He turned all the lessons into this post, full of guidelines you can implement on top of any cloud provider to stay safe.

  • Automatically prioritize security issues from different tools with an LLM by Daniel Grzelak

    Bad (or no) prioritization is a killer of security teams. This is a cool little experiment in using AWS Bedrock to prioritize security issues of different shapes and sizes, from disparate tools. It comes with Python code for three different prioritization approaches that have their own strengths and weaknesses, so you can adapt them to your environment.

Bonus: SecretsManager Harvesting in AWS

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Pleri is your AI-powered teammate built to boost your cloud security team — faster reactions, smarter actions, no extra headcount. Meet Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

    No resource updates this week.

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.