Monday,
February 16, 2026

🥖 Palette Cleanser

I thought for a second I was going mad this week and re-running last week's content. Last issue, "AI-assisted cloud intrusion achieves admin access in 8 minutes" was one of the ledes. This week we're asking how well an AI agent can run a cloud purple team exercise.

It's a little hidden, but AWS introduced new IAM condition keys that apply to requests coming through MCP servers, so you can deny actions via that path. It won't stop an agent using boto3 directly, but it's the first IAM primitive I'm aware of explicitly designed for the "AI agents calling AWS APIs" problem. It will be interesting to see how much utility these actually have in practice.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • Amazon CloudFront origin mTLS with open-source serverless CA by Paul Schwarzenberger

    AWS announced CloudFront mTLS to origins two weeks ago, and Paul walks through configuring end-to-end mutual TLS using an open-source serverless CA. The setup authenticates users to CloudFront, then CloudFront authenticates to API Gateway with its own certificate. One catch is that without a Lambda authorizer checking for CloudFront-specific headers, users with valid certs can bypass CloudFront and hit API Gateway directly.

  • Can an AI Agent Run a Purple Team Exercise? by Permiso

    Apparently, a fancy AI agent autonomously emulated Scattered Spider tactics against an AWS environment, created a privileged IAM user, attached AdministratorAccess, launched CloudShell to harvest creds, and attempted EC2 serial console enablement as a backdoor. Every technique triggered alerts, but the agent face-planted on some simple things. It failed to switch identities mid-operation, continuing to use the original federated session instead of the newly created IAM user. This won't stop the AI overlords for long.

  • TeamPCP: Cloud-Native Ransomware by Assaf Morag

    Are you into multi-cloud? TeamPCP is into multi-cloud. It/they (?) reportedly compromised 60,000+ servers, with 97% being cloud workloads (36% AWS, 61% Azure). It/they (?) target exposed Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers, then deploy a privileged DaemonSet that mounts the host filesystem across every node for instant cluster-wide persistence. Each compromised host becomes a scanner, creating worm-like propagation through cloud infrastructure.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Pleri logo

Meet Pleri: your AI-powered cloud security teammate. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

    No resource updates this week.

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

    No bulletins this week.

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.