Monday,
November 10, 2025

🥖 Palette Cleanser

Wassup amazing humans?! I can't promise you a $2,000 stimmy check (I mean cybersecurity dividend), but I hope the awesome AWS security content in this week's issue is enough to buy your votes on the socials.

December 1st is almost here, and you know what that means... The barrage of re:Invent announcements is about to start. Which security companies do you think AWS will crush this year? Or will it all be AI AI AI?

Google's acquisition of Wiz got one step closer to reality this week as it cleared US antitrust review. Now we just have to see what vision Europe has for cloud security. The deal is expected to close in 2026.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • Weaponizing the AWS CLI for Persistence by Hector Ruiz Ruiz

    Once your workstation or server gets pwned, all bets are off. Still, there's something very pleasant, almost soothing, about a simple CLI alias change that keeps sending creds to an attacker forever. This one is mostly for red teamers, detection engineers, and paranoid ops people who enjoy spiking their paranoia.

  • CloudFormation change set privilege escalation by Lucian Patian

    Once upon a time, the late Spencer Gietzen (I miss your work mate 😢) pointed out that you could escalate privileges in AWS by passing a role to CloudFormation. That's interesting, but of course that's why the PassRole permission exists and is often a barrier. Apparently that's not the case if you have the CreateChangeSet and ExecuteChangeSet permissions. Of course, no specific-sounding AWS-managed policy like SecretsManagerReadWrite would ever do such a thing, would it?!

  • Hacking India’s largest automaker: Tata Motors by Eaton Zveare

    There are no new lessons here: Don't put AWS access keys and secrets in client-side scripts. Don't implement encryption just for show. Limit the scope of IAM policies, etc. However, it is instructive to see how quickly and easily someone like Eaton can find these things and tear an entire cloud environment apart. Luckily, he's a good guy.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Pleri logo

Meet Pleri: your AI-powered cloud security teammate. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.