AWS Security Digest

Issue #245

Monday · January 26, 2026

🥖 Palate Cleanser

On 15 January AWS launched the very independent-sounding European Sovereign Cloud. It's physically and logically separate from other AWS regions, with EU-only operations, dedicated IAM, etc.

I'm no lawyer, but apparently, despite technical isolation, the CLOUD Act and FISA still allow U.S. authorities to request data regardless of infrastructure location. AWS remains a U.S.-headquartered company subject to U.S. jurisdiction. The Cloud Security Alliance has a detailed Q&A for worried souls.

First they gave us the aws partition, and we assumed it was universal. Then they gave us aws-us-gov, and we called it an exception. We ignored aws-cn. Now they give us aws-eusc, and it's time we found some silly partition confusion vulnerabilities. That's my dramatic reading of Scott Piper's prediction anyway. I may or may not have registered one or two popular s3 bucket names.

There wasn't much AWS-specific security content this week, but plenty that applies to many cloud providers, including AWS. If that's not your style, you can skip Chef's Selections.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • How Public Container Registries Have Become a Silent Risk Multiplier in a Modern Supply Chain by Amit Gadhave

    Amit scanned 34,000 Docker Hub images and found 2,500 confirmed malicious ones. Seventy percent were cryptominers, mostly typosquatted versions of nginx, ubuntu, and drupal that immediately fire up XMRig to mine Monero. The tells seem to be pretty simple: non-pronounceable usernames, pull counts under 1,000, and base image names that look right but aren’t.

  • VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun by Check Point

    Researchers found a malware framework written almost entirely by AI under one developer's direction. Using “Spec Driven Development,” they fed an AI assistant project requirements and sprint schedules, producing 88,000 lines of eBPF rootkits, cloud enumeration, and C2 code in under a week. Apparently, the developer's opsec sucked (planning docs left exposed), but the speed of AI-assisted malware development is the real headline.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🤖 Dessert

Every machine-tracked change this week. Nobody else assembles this.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes

Get every AWS security change,
on a plate every Monday.

6,700+ engineers, builders and CISOs let us diff the AWS changelog every week.