Monday,
May 11, 2026

🥖 Palette Cleanser

Copy Fail caught a CISA KEV listing last week. I guess it was worthy of branding because a tiny Python script gets you root on basically any Linux box from the last eight years and leaves nothing on disk for your file integrity tools to notice. AWS responded with bulletin 2026-026 plus five separate AL2023 livepatches. Kernel updates only take effect after restart, so livepatch is the option if you can't reboot, and reboot is the option if livepatch isn't trusted. Bottlerocket and EKS managed node groups get a clean update path but it's still customer-initiated. The exposure is everything else like self-managed nodes, ECS on EC2 with custom AMIs, and whatever long-tail Linux EC2 fleet you stopped looking at in 2024.

AWS doubled most IAM account-level limits this week. Roles, instance profiles, and customer managed policies all went from 5,000 to 10,000. The fun one is OIDC providers jumping 7x to 700. I wonder if there's a philosophical shift coming, with AWS leaning harder on OIDC over long-lived keys?

In sydney for AWS Summit this week? Come say hi at Plerion's booth, B11.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • From Leaked AWS Key to Data Exfiltration in 60 Seconds: Are We Ready? by Adan Álvarez

    Adan gave Claude Sonnet and Claude Haiku a leaked AWS access key and a prompt framing them as a pentester in a capture-the-flag competition, then timed the run from key to exfiltrated S3 object. 7 of 12 attempts succeeded in around 60 seconds, Sonnet doing most of the work. Every successful run followed the same path: enumerate IAM, pull cross-account creds from a staging bucket, assume the bigger role, find a bucket, download. If you are interested in detection, there are some decent signals in the article.

  • Credential isolation and least privilege for AWS agents by Alex Smolen

    Two weeks in a row from Alex. Maybe we need an ASD t-shirt for repeat offenders. Handing an AI agent real AWS keys is a bad time twice over because the agent can exfiltrate them, and you can't write a least-privilege policy in advance because you don't know yet what calls the agent will actually make. iam-agent-proxy sits between the two and solves both problems. The agent only ever sees fake keys (AKIAPROXY0000000001), so a leak is worthless to anyone who doesn't also have the proxy. The proxy validates the SigV4 on each request against those fakes, re-signs with the real creds, and forwards. Every call is logged as the resolved IAM action, so after a representative run you have a policy generated from observed behaviour rather than imagined behaviour.

  • AWS Credential Isolation for Local AI Agents by Alex Smolen

    This is a companion to the iam-agent-proxy piece above. If you want a local AI agent to call AWS without inheriting your shell identity or holding a long-lived key, how do you actually get credentials in? Env vars need manual reinjection on expiry, the ~/.aws files leak every profile you have, and IMDS emulation is a dead end on macOS because the AWS SDK's allowlist excludes host.docker.internal and the feature request to add it got closed as "not planned". Alex lands on Unix sockets and points to an existing tool called elhaz (only 9 stars - careful) that already does the job. It's a background daemon that holds short-lived STS creds in memory and hands them out over a socket file you mount into each agent. Filesystem perms are the access control, creds never touch disk, refresh is automatic. A bit of setup once to get it running but might be worth it.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

    No threads this week.

💸 Sponsor shoutout

Pleri logo

Meet Pleri: your AI security engineer. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

    No resource updates this week.

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.