🛎️ AWS Security Digest 283 is out! 1️⃣ I Gave 14 LLMs AWS Keys. Here's What They Wanted to Do Next by Adan Álvarez 2️⃣ Lambda Web Functions: public by default, and already in your lambda:* grants by Kobi Rubin 3️⃣ AWS Key Quarantine is Not Revocation by Truffle Security Research awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 282 is out! 1️⃣ Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access by Martin McCloskey 2️⃣ AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model by Tamir Ishay Sharbat and Lana Salameh 3️⃣ Inside Terraplane: How We Built Our Own Secure, Developer-Friendly Terraform at Act by Evyatar Cohen awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 281 is out! 1️⃣ Package Name to Role Credentials in Code Interpreter: Two RCE CVEs in the AgentCore Python SDK by Sergio Garcia 2️⃣ Context Bombs Against Abliterated AI Models by Alessandro Brucato 3️⃣ Read-Only AI Agents on AWS: Two Guardrails Failed in 2026, and IAM Held by Tatiana Mikhaleva 🦴 Mapping Scaleway IAM, An Attacker's View of the Trust Boundaries awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 280 is out! 1️⃣ What IAM Sees That You Don't by Dan Gansel 2️⃣ AWS Managed Policy Changes: Summer 2026 by Victor Grenu 3️⃣ From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies by Margaret Kelley 🦴 fwd:cloudsec Europe 2026 talk videos awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 279 is out! 1️⃣ A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity by Niv Rabin 2️⃣ Part 4: AWS SageMaker AI, SageMaker Unified Studio & App Runner (Escalating Privileges via AWS CodeConnections) by Thomas Preece 3️⃣ Exploring the new AWS Sign Up experience by Scott Piper awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 278 is out! 1️⃣ CloudTrail hunting for the SSM Agent SSRF (CVE-2026-89049) by Akira Nishikawa 2️⃣ Breaking LiteLLM from auth bypass to cloud compromise by Amitai Cohen and Yaara Shriki 3️⃣ Machine speed, hold the AI: hand-rolled marimo exploit by Sysdig awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 277 is out! 1️⃣ Reading other AWS accounts' SQL on Amazon Athena by Act Research 2️⃣ Password spraying campaign targets AWS root user accounts across 150+ organizations by Martin McCloskey awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 276 is out! 1️⃣ AWSHound: An OpenSource AWS OpenGraph Collector by Julian Catrambone 2️⃣ Data Exfiltration from Amazon Kiro via Prompt Injection by Fergal Glynn 3️⃣ A Wildberries Architected Framework by Chris Farris 4️⃣ I lost my mind doing an AWS external access review by Daniel Grzelak awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 275 is out! 1️⃣ 768 Leaked Corporate AWS Keys Held Full Admin Rights by Truffle Security Research 2️⃣ Open-source Post-quantum Cryptography Serverless CA by Paul Schwarzenberger 3️⃣ Threat hunt AI: How we built an AI security analyst on AWS for under $500/month by Pablo Vidal awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 274 is out! 1️⃣ A few notes on AWS Nitro Enclaves: KMS integration by Paweł Płatek 2️⃣ TrailTool 1.0: Identity-First Sessions for CloudTrail by Alex Smolen 3️⃣ A closed network path is not a closed execution path by Ramesh Ramani awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 273 is out! 1️⃣ OffGuard: Breaking the Most Popular AI Gateway from Auth Bypass to Cloud Compromise (Slides) by Yaara Shriki 2️⃣ CloudBashing: Exploiting free CloudShells for mining, networking, exfil, and persistence at scale (Slides) by Jenko Hwong and Chris Ryan awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 272 is out! 1️⃣ S3 Clones in the Neoclouds by Scott Piper 2️⃣ AgentCore or AgentSore: Cross-Agent Privilege Escalation in Bedrock AgentCore by Kennedy Torkura 3️⃣ A Security Analysis of Amazon S3 Vectors and Its Use in LLM Retrieval Pipelines by Ioan Criste and Emanuel Ioniță awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 271 is out! 1️⃣ When the AI Edits Its Own Trust Boundary: Remote Code Execution Vulnerability in AWS's Agentic IDE by Nicole Fishbein 2️⃣ Context bombs: stopping AI attackers in their tracks by Sam Cox 3️⃣ Show us Zee Pages by Rory McCune awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 270 is out! 1️⃣ OIDC tokens can now restrict which AWS roles they assume by Aidan Steele 2️⃣ Introducing ClickOps Sentinel: AI Context for AWS Console Changes by Victor Grenu 3️⃣ Investigating Persistence Mechanisms in AWS by Jan Blažek 🦴 Filtering S3 events by CloudFormation stack awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 269 is out! 1️⃣ The Two Mitigations for the Service Account Confused Deputy in the Cloud by Kat Traxler 2️⃣ AWS Just Added OAuth to the MCP Server. It Silently Changed the Meaning of Your Existing IAM by Bala Paranj 3️⃣ Agent Solves All 122 of Datadog's Pathfinding.cloud Labs by Eduard Agavriloae awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 268 is out! 1️⃣ Apps can now impersonate human access to AWS via IAM Identity Center by Aidan Steele 2️⃣ AWS Forensics: what you need to know by Nathanael Ndong 3️⃣ Why I Keep Recommending Amazon GuardDuty by Sena Yakut awssecuritydigest.com/past-i…

🛎️ AWS Security Digest 267 is out! 📋 We just launched the AWS Security Digest Top 10, an annual community-driven list of the year's most important AWS security research. Nominations are open. Chef's Selection: 1️⃣ MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension by Maor Dokhanian 2️⃣ Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond by Christophe Tafani-Dereeper awssecuritydigest.com/past-i…

Secure AWS credential isolation for local AI agents Alex Smolen Want your local AI agents to call AWS without inheriting your shell identity or storing long-lived keys? Alex drills into the pitfalls and a practical fix. 🔒 Problem: env vars need manual reinjection on expiry; ~/.aws reveals every profile; IMDS emulation is a dead end on macOS because the AWS SDK allowlist excludes host.docker.internal and the feature request was closed as "not planned". 🧭 Approach: use Unix sockets — run a background daemon (elhaz) that holds short-lived STS creds in memory and serves them over a mounted socket file. Filesystem perms act as access control, creds never touch disk, and refresh is automatic. ⚠️ Caveat: elhaz is small (9 stars) — promising but vet before production use. Worth a one-time setup if you need least-privilege, ephemeral creds for local agents. This was first mentioned in AWS Security Digest Issue #260: awssecuritydigest.com/past-i…

Credential isolation and least privilege for AWS agents Alex Smolen Handing an AI agent real AWS keys is risky — iam-agent-proxy solves that by giving agents fake keys and proxying requests so real creds never touch the agent. 🔐 Agent gets fake keys (e.g., AKIAPROXY0000000001); proxy validates SigV4 against those fakes, re-signs with the real credentials, and forwards the call. 🧾 Every call is logged as the resolved IAM action, so you can generate a least-privilege policy from observed behavior rather than guessing. 🔁 Key insight: run representative sessions to capture actual API usage; leaked fake keys are useless without the proxy. This was first mentioned in AWS Security Digest Issue #260: awssecuritydigest.com/past-i… Read here: engseclabs.com/blog/iam-agen…

From Leaked AWS Key to Data Exfiltration in 60 Seconds: Are We Ready? Adan Álvarez Adan handed a leaked AWS key to Claude Sonnet and Claude Haiku as pentesters and timed the run. 7 of 12 attempts succeeded in ~60 seconds (Sonnet did most of the heavy lifting). Every success followed the same chain: enumerate IAM → pull cross-account creds from a staging S3 bucket → assume a larger role → find a bucket → download an object. 🔎 Key takeaways: - 7/12 rapid wins show a repeatable, automatable attack path that defenders should expect. - The experiment reveals concrete detection opportunities: unusual sts:AssumeRole chains, reads from staging buckets using temporary creds, bursts of IAM enumeration, and correlated CloudTrail entries tying those events together. - Practical defenses hinted at: lock down staging buckets, tighten role trust policies, monitor cross-account S3 reads and assume-role activity. This was first mentioned in AWS Security Digest Issue #260: awssecuritydigest.com/past-i… Read Adan’s full run-down for the timeline, prompts used, and detection signals here: medium.com/@adan.alvarez/fro…