AWS Security Digest

Monday,
March 23, 2026

🥖 Palette Cleanser

If you've been following this newsletter for a while, you'll know MAMIP (Monitor AWS Managed IAM Policies). Victor Grenu, the original founder of this newsletter, has been tracking every silent change AWS makes to managed policies since 2019. This week, MAMIP got a major upgrade and a new name: IAMTrail. Same mission, now with a proper interface, visualizations, diffs, and email notifications. Over 1,500 active policies tracked, 4,473 commits of history, and enough data to spot that ReadOnlyAccess has been through 178 versions. Give Victor some love.

Someone turned AWS CloudShell's free persistent storage into a distributed file system spanning multiple regions, complete with UDP hole-punching, and AES-256 encryption. Fun hack, but it's also a reminder that CloudShell's free 1GB of persistent storage per region could serve as attacker infrastructure or a staging area in a compromised AWS environment.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

Pwning AI Code Interpreters in AWS Bedrock AgentCore by Kinnaird McQuade

AWS Bedrock AgentCore Code Interpreter's "Sandbox" mode promises complete network isolation, but Kinnaird found that DNS queries slip right through. To prove the impact, he built a full DNS C2 protocol. The attacker delivers commands inbound via DNS A record responses with each IP octet encoding an ASCII character of base64 data, and the sandbox phones home by embedding output in outbound DNS subdomain queries. The result is a full interactive reverse shell. AWS acknowledged the issue, decided not to fix it, and updated the docs to say "sandbox mode allows DNS resolution." The PoC is open-sourced. If your Code Interpreter's IAM role can touch S3, so can an attacker with a malicious CSV and a DNS server.
Pentesting a Pentest Agent: Here's What I've Found in AWS Security Agent by Richard Fan

Richard turned the tables and pentested AWS Security Agent, AWS's own autonomous AI pentesting tool. The most alarming find: a multi-stage chain starting with debug message injection, bypassing guardrails by wrapping malicious requests in emotional narratives, then escalating privileges and escaping the container, and pulling instance credentials straight from IMDS. AWS classified it within their "documented threat model." He also found the agent happily runs DROP TABLE during SQL injection probes and dumps discovered credentials into reports unredacted. As AI agents get more autonomy in your AWS environment, this is the kind of research worth sitting with.
UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours by Ravie Lakshmanan

I missed this a few weeks back. UNC6426 is a threat actor tracked by Mandiant. They compromised the nx npm package with a malicious postinstall script that harvested GitHub tokens from developer machines. Those tokens were enough to abuse an overly permissive GitHub Actions-to-AWS OIDC trust relationship and create a brand new admin IAM role in the victim's AWS account. Once in, they used Nord Stream, an open-source tool designed to extract secrets stored in CI/CD pipelines, to hoover up credentials across the environment. The whole environment was cooked in 72 hours. S3 buckets exfiltrated and production intances terminated. OIDC is great but it just outsources your security to Github (or whatever CI/CD platform).

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Meet Pleri: your AI-powered cloud security teammate. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🥖 Palette Cleanser

📋 Chef's selections

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

🤖 Dessert

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes