Sponsor shoutout

One cloud finding can take 2 to 3 hours to investigate before anyone touches a fix. Plerion's agents do that work in minutes: is it reachable, who owns it, what's the blast radius. See the platform or get a free assessment.

Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access

by Martin McCloskey

Attackers who collect stolen AWS keys check each one before they use it, to see if it still works and what it can do. Usually they want to run cryptominers on EC2 or send spam through SES. Now they also check whether a key can call Bedrock, because people will pay for cheap access to models like Claude. Martin found a credential harvesting platform probing more than 80 Datadog customers, plus two checker scripts on VirusTotal. One script calls GetCallerIdentity, then ListFoundationModels across regions, then a Converse request that just says "ping" with a 4-token limit. Cheap, quiet, and enough to tell the attacker what the key is worth. Apparently there's a single error that tells the script that every Claude model is blocked, so it stops trying in that region. Detection ideas and IOCs are at the end.

AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model

by Tamir Ishay Sharbat and Lana Salameh

I'm sensing a theme here. Allowing execution role creds to be stolen = bad. Previous examples include Ori Hadad grabbing credentials from the Code Interpreter's metadata service, and Sergio Garcia doing the same through a package name injection in last week's issue. AgentCore Runtime runs each agent in a microVM that can still reach the instance metadata service. The Zenity team prompt-injected an agent into making an HTTP request to 169.254.169.254, and it handed back its execution role's credentials, which worked from outside AgentCore. The default role was over-permissioned, so those credentials could pull other agents' container images, invoke private agents, read users' conversations with ListEvents and plant persistent memories with CreateEvent. AWS called it "documented and expected" and made new agents IMDSv2-only in February. Zenity only saw the default role narrowed in late September.

Inside Terraplane: How We Built Our Own Secure, Developer-Friendly Terraform at Act

by Evyatar Cohen

Terraform changes infrastructure in two steps. A "plan" works out what would change, and an "apply" actually makes the changes. Many pipelines have one powerful set of AWS credentials around for both steps, so anything sneaky that runs during a plan gets the keys to everything. Evyatar's team built their own runner that gives each run separate, fresh AWS credentials that expire after about an hour. Every request for credentials carries a signed label saying which workspace and which step it's for, and AWS only gives the plan step a read-only role. Only a run a person has approved can get the role that makes changes (unless a workspace opts into auto-apply), so your favorite agent or an attacker can plan changes but can't press Apply. Cool but can we has the source code pls?