Sponsor shoutout

When everything is critical, nothing is. Plerion's agents check each finding against your real environment, including reachability, identity and exposure, and surface the few an attacker could actually use. Then they fix them. See the platform or get a free assessment.

I Gave 14 LLMs AWS Keys. Here's What They Wanted to Do Next

by Adan Álvarez

This is a really clever idea for both brainstorming and stress-testing detection setups. Adan gave 14 models 13 post-compromise situations, from "you just got some keys and know nothing yet" to "CloudTrail is about to record your next move", asked each one 20 times what it would do next, and mapped every proposed command to the CloudTrail event it would create. Nothing was actually run. Twelve of the 14 open with GetCallerIdentity, most persist with a new IAM user and access key, and when a model knows a secret is there it proposes reading it 87% of the time, which is bad for your rotation backlog and great for your honeytokens.

Lambda Web Functions: public by default, and already in your lambda:* grants

by Kobi Rubin

AWS launched Lambda Web Functions on 12 October, which run an ordinary Node.js web server behind a Lambda-managed HTTPS domain, with many requests sharing one environment. Kobi pulled out some of the most notable security implications. For example, the CLI's one-shot deploy creates the endpoint as ApplicationManaged, which means no authentication, and the resource policy is not evaluated for invokes. The new actions sit in the lambda namespace, so anyone holding lambda:* or AWSLambda_FullAccess got them on launch day. Better still, an SCP that denies function URLs when lambda:FunctionUrlAuthType is NONE does not match CreateWebFunctionEndpoint, so if that is how you closed public Lambda, it is open again. The post has the replacement condition key and a list of posture tools that can't see the new resource yet.

AWS Key Quarantine is Not Revocation

by Truffle Security Research

This feels like it's been done to death already but let's do it again anyway. When AWS finds your access key in public, it attaches a quarantine policy to the user. That policy is a deny list, and the key keeps working. The researchers went back to 929 leaked keys that still authenticated with quarantine attached, and on 894 of them the user's own policies still granted something dangerous the deny list misses, like sts:AssumeRole, ssm:SendCommand or reading secrets. Pawel Rzepa, Tibor Hercz, Chris Farris, Nathaniel Quist and William Gamazo, Michael Clark, Bleon Proko, Margaret Kelley and Corey Quinn have all poked at the quarantine policies before.