🔶 AWS AgentCore: The Overlooked Privilege Escalation Path in Bedrock's AI Tooling

Deep-dive into a privilege escalation path in AWS's new Bedrock AgentCore tooling, specifically the Code Interpreters used by AI agents.

https://sonraisecurity.com/blog/aws-agentcore-privilege-escalation-bedrock-scp-fix/

(Use VPN to open from Russia)

#aws

🔴 Introducing Google Cloud Setup

Google Cloud Setup helps you quickly implement a robust cloud foundation based on recommended best practices, to get up and running quickly.

https://cloud.google.com/blog/products/devops-sre/introducing-google-cloud-setup/

(Use VPN to open from Russia)

#gcp

🔶 Secure file sharing solutions in AWS: A security and cost analysis guide

Securely share sensitive data with time-limited, nonce-enhanced presigned URLs that prevent replay attacks, minimizing exposure risks through granular access controls and rigorous monitoring.

https://aws.amazon.com/ru/blogs/security/how-to-securely-transfer-files-with-presigned-urls/

(Use VPN to open from Russia)

#aws

🔶 Secure file sharing solutions in AWS: A security and cost analysis guide: Part 2

In this second part of a two-part post, you can learn about multiple solutions for secure file sharing using AWS services and the pros and cons of each.

https://aws.amazon.com/ru/blogs/security/secure-file-sharing-solutions-in-aws-a-security-and-cost-analysis-guide-part-2/

(Use VPN to open from Russia)

#aws

🔶 Implementing Defense-in-Depth Security for AWS CodeBuild Pipelines

Key points include understanding webhook configurations, establishing trust boundaries, and implementing least-privilege access.

https://aws.amazon.com/ru/blogs/security/implementing-defense-security-for-aws-codebuild-pipelines/

(Use VPN to open from Russia)

#aws

🔶 Under the Hood of Amazon ECS on EC2: Agents, IAM Roles, and Task Isolation | Naor Haziz

This deep-dive explores Amazon ECS on EC2's internals, focusing on the ECS agent's role, IAM credential delivery mechanisms, and task isolation boundaries between containers sharing the same host.

https://naorhaziz.com/posts/under-the-hood-of-amazon-ecs/

#aws

🔶 ECScape: Understanding IAM Privilege Boundaries in Amazon ECS

This article details "ECScape," a technique allowing malicious containers in Amazon ECS to steal IAM credentials from other tasks on shared EC2 hosts by impersonating the ECS agent's control plane connection.

https://www.sweet.security/blog/ecscape-understanding-iam-privilege-boundaries-in-amazon-ecs

#aws

🔶 Malware analysis on AWS: Setting up a secure environment

The basic steps to build isolated sandbox environments, robust security controls, and proper monitoring policies to safely analyze malware.

https://aws.amazon.com/ru/blogs/security/malware-analysis-on-aws-setting-up-a-secure-environment/

#aws

🔶 Introducing AWS Cloud Control API MCP Server

This MCP server allows to create, read, update, delete, and list resources using natural language.

https://aws.amazon.com/ru/blogs/devops/introducing-aws-cloud-control-api-mcp-server-natural-language-infrastructure-management-on-aws/

(Use VPN to open from Russia)

#aws

🔶 Using AWS Certificate Manager as a covert exfiltration mechanism

This article demonstrates how AWS Certificate Manager can be exploited as a data exfiltration mechanism by storing arbitrary data in X.509 certificates' nsComments extension, allowing up to 2MB per certificate.

https://me.costaskou.com/articles/acmfs/

#aws

🔶 Enumerating AWS the quiet way: CloudTrail-free discovery with Resource Explorer

Discover how attackers could quietly enumerate AWS resources via Resource Explorer, and how Datadog and AWS worked together to close the visibility gap.

https://securitylabs.datadoghq.com/articles/enumerating-aws-the-quiet-way-cloudtrail-free-discovery-with-resource-explorer/

#aws

🔶 Another ECS Privilege Escalation Path

Post covering a privilege escalation vector which relies on using functionality designed for the ECS agent to self-register a compromised EC2 and override a task definition.

https://labs.reversec.com/posts/2025/08/another-ecs-privilege-escalation-path

#aws

🔴 Now available: Cloud HSM as an encryption key service for Workspace client-side encryption

To help highly-regulated organizations meet their encryption key service obligation, Google is now offering Cloud HSM for Google Workspace CSE customers.

https://cloud.google.com/blog/products/identity-security/introducing-cloud-hsm-as-an-encryption-key-service-for-workspace-cse/

#gcp

🔴 From silos to synergy: New Compliance Manager, now in preview

Google Cloud Compliance Manager, now in preview, can help simplify and enhance how organizations manage security, privacy, and compliance in the cloud.

https://cloud.google.com/blog/products/identity-security/streamline-auditing-compliance-manager-is-now-in-preview/

#gcp

🔶 AWS CDK and SaaS Provider Takeover

This article details a vulnerability where SaaS providers using AWS CDK bootstrap roles could have their accounts taken over through their own platform due to permissive IAM role trust policies lacking external ID protections.

https://blog.ryanjarv.sh/2025/07/21/saas-provider-takeover.html

#aws

🔶 A new type of long-lived key on AWS: Bedrock API keys

AWS has introduced a new type of long-lived key called Bedrock API keys, which are used for authenticating applications. These keys are created through the IAM API and can have an expiration time set, but there's no way to enforce this via IAM policy conditions.

https://www.wiz.io/blog/a-new-type-of-long-lived-key-on-aws-bedrock-api-keys

(Use VPN to open from Russia)

#aws

🔶 AWS CDK and SaaS Provider Takeover

This article details a vulnerability where SaaS providers using AWS CDK bootstrap roles could have their accounts taken over through their own platform due to permissive IAM role trust policies lacking external ID protections.

https://blog.ryanjarv.sh/2025/07/21/saas-provider-takeover.html

(Use VPN to open from Russia)

#aws

🔶 Simplify multi-tenant encryption with a cost-conscious AWS KMS key strategy

An efficient approach to managing encryption keys in a multi-tenant SaaS environment through centralization, addressing challenges like key proliferation, rising costs, and operational complexity across multiple AWS accounts and services.

https://aws.amazon.com/ru/blogs/architecture/simplify-multi-tenant-encryption-with-a-cost-conscious-aws-kms-key-strategy/

(Use VPN to open from Russia)

#aws

🔶 Sandboxed to Compromised: Credential Exfiltration Paths in AWS Code Interpreters

The article discusses security vulnerabilities in AWS Code Interpreters, particularly focusing on sandboxed environments, and demonstrates that even sandboxed interpreters can access certain AWS services like S3, and their role credentials can be extracted through the Metadata Service.

https://sonraisecurity.com/blog/sandboxed-to-compromised-new-research-exposes-credential-exfiltration-paths-in-aws-code-interpreters/

(Use VPN to open from Russia)

#aws