Monday,
March 09, 2026

🥖 Palette Cleanser

When your local security professional goes on and on about "blast radius", this is what they are talking about... This week LexisNexis confirmed a breach of their AWS infrastructure. Attackers exploited an unpatched React app to gain access, then pivoted through an overly permissive ECS task role that had read access to every secret in the account, including the production Redshift master credential. The result was 536 Redshift tables, 53 AWS Secrets Manager secrets in plaintext, and 3.9M database records exfiltrated.

Since everyone wants to play AI, AWS just launched a Lightsail OpenClaw template. A private AI chat gateway that runs entirely in your AWS account, pre-configured with Amazon Bedrock and Claude Sonnet 4.6 by default. No Mac Mini required. Your prompts, your account, your infrastructure, so you can now rm -rf your entire AWS account by accident, for funsies. :)

Finally, Scott Piper is getting the word out for more folks to join the Cloud Security Forum Slack. It's the go-to place for deep discussion on cloud security from practitioners, consultants, and cloud provider employees alike. It's also affiliated with fwd:cloudsec. DM Scott for an invite, and ask him for a cloud security history lesson while you're at it.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • The AWS Console and Terraform Security Gap by Laurence Tennant

    This one's a couple of weeks old but too good not to admit I missed it. The AWS Console now enforces secure defaults like RDS encryption and requiring a source ARN on Lambda permissions, but Terraform inherits the legacy API defaults where storage_encrypted is false and source_arn is optional. That means the same resource created via Console vs Terraform can have wildly different security postures. Oops. Useful walkthrough of the gaps, plus practical fixes with SCPs, Trivy, and golden modules.

  • Stop Enabling Every AWS Security Service by Sena Yakut

    Security services are good, right? This practical reminder that turning on every AWS security service on day one gets you thousands of alerts nobody investigates and dashboards nobody checks. Sena reckons you should start with threat modeling your actual architecture, figure out where your real breaking points are, and then pick the controls that match. Good coverage of cost awareness, service overlap with third-party tools, and why IAM Identity Center with temporary credentials beats piling on more monitoring.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

    No threads this week.

💸 Sponsor shoutout

Pleri logo

Meet Pleri: your AI-powered cloud security teammate. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

    No changes this week.

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.