Monday,
March 16, 2026

🥖 Palette Cleanser

Happy birthday S3! Twenty years ago on Pi Day, AWS quietly launched a little service that would store objects on the internet. What started as an internal need for elastic, scalable storage is now foundational infrastructure for AI workloads, data lakes, and just about everything else. To celebrate, AWS gave us all a present: account-regional namespaces that finally kill bucketsquatting. More on that below. Meanwhile, AWS is expanding Security Hub into multicloud, which feels weird but fun.

In case you missed it, CodeBuild recently got two new IAM condition keys that are super useful: codebuild:BuildArn and codebuild:ProjectArn. You can now scope IAM policies to specific builds or projects, so your CodeBuild role can prove where it came from when accessing other AWS resources. Think of it like aws:SourceArn but for your CI/CD pipeline. No more overly broad build roles.

Not really AWS related but I'm sure many of us are feeling it... Rich Mogull wrote a piece for CSA on why one IAM to rule all your AI agents doesn't work. He breaks agents into "islands of identity" - personal desktop agents, coding agents, SaaS agents, and enterprise agents - each with fundamentally different IAM needs. I'm increasingly running into this problem myself, and it's clear nobody has a good answer yet. Kane Narraway dug into the practical side this week, pointing out that OAuth scopes are way too broad for agents ("you don't get 'read the last 5 emails about Project X,' you get 'read access to your entire inbox'") and estimating 2-3 years before access control is genuinely solved for agents. Expect demos soon.

The Plerion team, including the founder, will be in San Francisco next week (March 23-26) for RSAC. Reach out to Keith Davison to grab a coffee or an adult beverage.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • Bucketsquatting is (Finally) Dead by Ian Mckay

    After a decade of reporting bucketsquatting issues to AWS, Ian finally gets to write the happy ending. AWS introduced a new namespace syntax for S3 buckets that embeds your account ID and region into the name (e.g., myapp-123456789012-us-west-2-an). No more registering a bucket and waiting for it to be used, nor waiting for the moment when the bucket is deleted so it can be sniped. AWS is recommending using the namespace for all new buckets, but that feels like a lesson not learned from years of bucket exposures. Just force it as the default, my friends! Another angle focused on shadow resources here.

  • Behind the console: Active phishing campaign targeting AWS console credentials by Martin Mc Closkey

    Martin caught an active adversary-in-the-middle phishing campaign going after AWS Console creds via typosquatted domains like cloud-recovery[.]net. The kit proxies real-time auth to the legitimate AWS sign-in endpoint, validates credentials on the fly, and likely captures OTP codes too. Post-compromise console access was observed within 20 minutes of credential submission (why so long?!), originating from Mullvad VPN infrastructure. Not an AWS vuln, but a reminder that your AWS credentials are only as strong as the humans typing them.

  • Visualizing AWS Relationships and Attack Paths by pathsec

    A new open-source tool for mapping AWS resource relationships and identifying attack paths. The aws-visualizer ingests resources across regions (EC2, VPCs, subnets, security groups, IAM, Lambda) and renders them as an interactive Cytoscape.js graph where you can filter by region/service and trace relationships. It integrates pathfinding.cloud for IAM privilege escalation analysis. I haven't used it, and I couldn't find a real name for the author, so try it at your own risk.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Pleri logo

Meet Pleri: your AI-powered cloud security teammate. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

    Too many to list...

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

    No bulletins this week.

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.