Monday,
December 22, 2025

🥖 Palette Cleanser

I'm at the stage of life where friends are losing loved ones, so this week's issue will be brief. There's still some truly incredible content, but apologies, my usual verve is not. Merry Christmas and Happy New Year to all. <3

The zeroday.cloud competition came and went. Lots of cloudy software got pwnt. Full write-up here.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • Introducing Pathfinding.cloud by Seth Art

    An extremely nondescriptive title for what may be the best piece of AWS security content released all year. For a long time, AWS privilege escalation has been hard to track and understand. Yes, there are lists, but they are brief and lack metadata. You can't build tooling or a comprehensive framework around them without a lot of work. That's all changing thanks to Seth.

  • AWS Privilege Escalation Techniques by Ben Goodspeed

    Speaking of AWS privesc, Ben is having some fun too. He walks through how AWS privilege escalation has evolved from classic IAM misconfigurations into service-driven and now AI-orchestrated attack paths, with modern services like Bedrock and AgentCore acting as new execution and delegation hubs. The key takeaway is that privilege today emerges from how services execute code and chain actions on your behalf, and while many of these paths remain exploitable by default, well-designed SCPs and service-level guardrails can still shut them down reliably.

  • Goodbye to Static Credentials: Embrace Modern Identity Practices by Eyal Estrin

    This is a refresher on why static credentials are dangerous and why temporary, identity-based access is the right default, but it largely covers well-established best practices rather than new research. It’s most useful for cross-cloud environments (AWS, Azure, GCP), Kubernetes workloads, and teams migrating off legacy service accounts, and less useful for organizations that have already standardized on roles, workload identity, and short-lived credentials everywhere.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Pleri logo

Meet Pleri: your AI-powered cloud security teammate. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.