Monday,
May 04, 2026

🥖 Palette Cleanser

Sometimes it feels like everyone is moving from cloud security to AI security. This week there weren't many AWS security articles so I went a few weeks back to find 2 awesome articles I missed (sorry) when they were published. I think you'll enjoy them even if they aren't strictly from this week. The alternative is... more AI. 😬

AWS dropped a breakdown of the March 2026 update to their Threat Technique Catalog. The thing that stood out to me is the Cognito Refresh Token Abuse. It stood out because it implies it's happening regularly enough to warrant inclusion. If an attacker grabs a refresh token from credential theft or compromised browser storage, they can silently call cognito-idp:GetTokensFromRefreshToken to mint fresh access and ID tokens whenever they want. Default refresh token lifetime is 30 days and is configurable up to 10 years, and without rotation enabled the same token keeps working for that entire window. Persistence with no password reset, no MFA prompt, and a CloudTrail event that blends in with legitimate client renewals.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • Unexpected Routing Behaviour in AWS with VPC Peering and NAT Gateway by Aleksi Kallio

    AWS docs say a VPC peering connection needs return routes configured on both sides for stateful traffic to flow. Aleksi found that's not the case when the originating subnet's route table points the peer's CIDR at a NAT gateway instead of directly at the peering connection. The peer becomes reachable even with no peering route configured back, and even an explicit return route pointing somewhere other than the peering connection gets ignored on the response leg. AWS confirmed it as "expected behaviour", attributing it to connection tracking and route caching that can persist for up to 5 days after the route is removed. Kind of obvious once you remember the NAT gateway is doing connection tracking, but not explicitly stated in the docs. Route tables are not a security control. Security Groups and NACLs are.

  • TrailTool: CloudTrail for AI Agents by Alex Smolen

    Pointing Claude at raw CloudTrail to ask "did contractor@company.com update this S3 bucket in the last 30 days?" burns tokens and context window on undifferentiated query-stitching across terabytes of logs. Alex built TrailTool, an open-source pre-aggregator that ingests CloudTrail with Lambda, caches it in DynamoDB, and groups events into People, Sessions, Roles, Services, and Resources so the agent skips straight to reasoning. Walks through four AWS-native workflows including detecting ClickOps and converting to IaC, generating least-privilege IAM policies (via iamlive mappings) from real session activity, auto-resolving AccessDenied errors, and validating break-glass sessions against the operator's stated justification. Pretty damn cool.

  • Every PaaS Breach Becomes an AWS Breach by hackaws.cloud

    The world gave us everything aaS. We took it all and now it's virtually impossible to build a modern business without lots of aaS. Unfortunately, it all needs to integrate together somehow, so we diligently stick some of our most sensitive credentials in the aaS. There's nothing inherently special about those platforms and eventually they get breached or pseudo-breached and we are left to clean up. This article makes the claim it's a pattern but the most important thing to remember is to try to use short-lived integrations like OIDC where possible and limit the permissions you give away because eventually you'll be cleaning up the mess.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

    No threads this week.

💸 Sponsor shoutout

Pleri logo

Meet Pleri: your AI security engineer. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.