AWS Security Digest

Monday,
June 08, 2026

🥖 Palette Cleanser

fwd:cloudsec North America wrapped up last week in Washington State. A recurring theme was Bedrock AgentCore turning into a real attack surface, with cloud identity and the data perimeter close behind. The full set of talk videos is up; the AWS ones worth your time:

No Way Out? C2 Through AWS Data Perimeter via Bedrock-AgentCore by Dan Gansel - a working command-and-control channel punched straight through the data perimeter.
Sub:jugation: Hijacking Cloud Identities by Recycling Namespaces in Global OIDC Issuers by Tal Skverer - reclaim a dead OIDC namespace and assume someone else's IAM roles.
Discovering New AWS Privilege Escalation Paths with an AI-Driven Workflow by Seth Art - new IAM privesc paths, found and validated by an agent.
Data Perimeters: Beyond the Marketing by Matt Luttrell - first-party AWS guidance on actually building a data perimeter, the defensive counterweight to Gansel.
Paying More for Worse Security: An AWS Marketplace Horror Story by Corey Quinn - Marketplace AMIs that cost more and secure less.
Transforming Security Incident Metadata to Security Outcomes by Cydney Stude and Steve de Vera - a threat-technique catalog built from real AWS incidents.
Schrödinger's Detection: Finding the "Zombie" Rules in Your SIEM by Gowthamaraj Rajendran - the dead detection rule that silently matches nothing, opening on an AWS IAM privesc Sigma rule.
I made AI agents apply for my Security Team. Then I gave the agents access to AWS. by Cole Horsman - autonomous AI agents given scoped machine identities and set loose to remediate hundreds of AWS IAM identities.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

Sub:jugation: Hijacking Cloud Identities by Recycling Namespaces in Global OIDC Issuers by Tal Skverer

The advice everyone gives is to ditch static CI/CD keys for OIDC federation, and Tal's fwd:cloudsec talk is the writeup of why that swap has a sharp edge. Issuers like GitHub Actions, GitLab CI, and HCP Terraform are global and shared, and the trust policy you write keys off a subject built from a namespace path like an org or repo name. Delete that org and someone else can register it, mint a token whose subject matches your forgotten IAM role trust policy, and assume the role, with no creds and no phishing. Tal found 14% of the AWS namespaces he checked were unregistered and takeable. If you federate into AWS from anything, this is the one to read.
No Way Out? Bypassing the AWS Data Perimeter with Bedrock AgentCore by Dan Gansel

The data perimeter is sold as the boundary that stops your credentials from talking to anything outside your org, and Dan built a working C2 channel right through it using nothing but legitimate AgentCore API calls. Exfil rides the server-side discovery-URL validation requests that originate from AWS's own infrastructure, and the inbound channel rides a Protected Resource Metadata API that answers from inside the VPC even when the endpoint policy denies everything, and never shows up in CloudTrail. AWS patched the inbound half and waved off the exfil half as "standard for OIDC client behavior," which is the part worth arguing about.
The HazyBeacon Protocol: How Malware Weaponizes AWS Lambda Function URLs by Aniket Harne

HazyBeacon is a real-world espionage campaign that turns the victim's own AWS account into its command-and-control. With stolen IAM creds it deploys Lambda functions fronted by Function URLs set to AuthType NONE, then proxies its traffic through trusted *.lambda-url.*.on.aws domains so IP and domain reputation never fire. First caught hitting Southeast Asian government networks, it is a clean example of an attacker borrowing AWS infrastructure instead of standing up their own. Aniket's writeup maps the campaign to ATT&CK and gives the high-signal controls that catch it.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

QuickSight Chatbot Bypasses Data Download Restriction

💸 Sponsor shoutout

Meet Pleri: your AI security engineer. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🥖 Palette Cleanser

📋 Chef's selections

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

🤖 Dessert

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes