🔶 Under the Hood of Amazon ECS on EC2: Agents, IAM Roles, and Task Isolation | Naor Haziz

This deep-dive explores Amazon ECS on EC2's internals, focusing on the ECS agent's role, IAM credential delivery mechanisms, and task isolation boundaries between containers sharing the same host.

https://naorhaziz.com/posts/under-the-hood-of-amazon-ecs/

#aws

🔶 ECScape: Understanding IAM Privilege Boundaries in Amazon ECS

This article details "ECScape," a technique allowing malicious containers in Amazon ECS to steal IAM credentials from other tasks on shared EC2 hosts by impersonating the ECS agent's control plane connection.

https://www.sweet.security/blog/ecscape-understanding-iam-privilege-boundaries-in-amazon-ecs

#aws

🔶 Malware analysis on AWS: Setting up a secure environment

The basic steps to build isolated sandbox environments, robust security controls, and proper monitoring policies to safely analyze malware.

https://aws.amazon.com/ru/blogs/security/malware-analysis-on-aws-setting-up-a-secure-environment/

#aws

🔶 Introducing AWS Cloud Control API MCP Server

This MCP server allows to create, read, update, delete, and list resources using natural language.

https://aws.amazon.com/ru/blogs/devops/introducing-aws-cloud-control-api-mcp-server-natural-language-infrastructure-management-on-aws/

(Use VPN to open from Russia)

#aws

🔶 Using AWS Certificate Manager as a covert exfiltration mechanism

This article demonstrates how AWS Certificate Manager can be exploited as a data exfiltration mechanism by storing arbitrary data in X.509 certificates' nsComments extension, allowing up to 2MB per certificate.

https://me.costaskou.com/articles/acmfs/

#aws

🔶 Enumerating AWS the quiet way: CloudTrail-free discovery with Resource Explorer

Discover how attackers could quietly enumerate AWS resources via Resource Explorer, and how Datadog and AWS worked together to close the visibility gap.

https://securitylabs.datadoghq.com/articles/enumerating-aws-the-quiet-way-cloudtrail-free-discovery-with-resource-explorer/

#aws

🔶 Another ECS Privilege Escalation Path

Post covering a privilege escalation vector which relies on using functionality designed for the ECS agent to self-register a compromised EC2 and override a task definition.

https://labs.reversec.com/posts/2025/08/another-ecs-privilege-escalation-path

#aws

🔴 Now available: Cloud HSM as an encryption key service for Workspace client-side encryption

To help highly-regulated organizations meet their encryption key service obligation, Google is now offering Cloud HSM for Google Workspace CSE customers.

https://cloud.google.com/blog/products/identity-security/introducing-cloud-hsm-as-an-encryption-key-service-for-workspace-cse/

#gcp

🔴 From silos to synergy: New Compliance Manager, now in preview

Google Cloud Compliance Manager, now in preview, can help simplify and enhance how organizations manage security, privacy, and compliance in the cloud.

https://cloud.google.com/blog/products/identity-security/streamline-auditing-compliance-manager-is-now-in-preview/

#gcp

🔶 AWS CDK and SaaS Provider Takeover

This article details a vulnerability where SaaS providers using AWS CDK bootstrap roles could have their accounts taken over through their own platform due to permissive IAM role trust policies lacking external ID protections.

https://blog.ryanjarv.sh/2025/07/21/saas-provider-takeover.html

#aws

🔶 A new type of long-lived key on AWS: Bedrock API keys

AWS has introduced a new type of long-lived key called Bedrock API keys, which are used for authenticating applications. These keys are created through the IAM API and can have an expiration time set, but there's no way to enforce this via IAM policy conditions.

https://www.wiz.io/blog/a-new-type-of-long-lived-key-on-aws-bedrock-api-keys

(Use VPN to open from Russia)

#aws

🔶 AWS CDK and SaaS Provider Takeover

This article details a vulnerability where SaaS providers using AWS CDK bootstrap roles could have their accounts taken over through their own platform due to permissive IAM role trust policies lacking external ID protections.

https://blog.ryanjarv.sh/2025/07/21/saas-provider-takeover.html

(Use VPN to open from Russia)

#aws

🔶 Simplify multi-tenant encryption with a cost-conscious AWS KMS key strategy

An efficient approach to managing encryption keys in a multi-tenant SaaS environment through centralization, addressing challenges like key proliferation, rising costs, and operational complexity across multiple AWS accounts and services.

https://aws.amazon.com/ru/blogs/architecture/simplify-multi-tenant-encryption-with-a-cost-conscious-aws-kms-key-strategy/

(Use VPN to open from Russia)

#aws

🔶 Sandboxed to Compromised: Credential Exfiltration Paths in AWS Code Interpreters

The article discusses security vulnerabilities in AWS Code Interpreters, particularly focusing on sandboxed environments, and demonstrates that even sandboxed interpreters can access certain AWS services like S3, and their role credentials can be extracted through the Metadata Service.

https://sonraisecurity.com/blog/sandboxed-to-compromised-new-research-exposes-credential-exfiltration-paths-in-aws-code-interpreters/

(Use VPN to open from Russia)

#aws

🔶 Use scalable controls to help prevent access from unexpected networks

AWS has introduced three new global condition keys for scalable access controls based on request origin: aws:VpceAccount, aws:VpceOrgPaths, and aws:VpceOrgID.

https://aws.amazon.com/blogs/security/use-scalable-controls-to-help-prevent-access-from-unexpected-networks/

(Use VPN to open from Russia)

#aws

🔶 AWS Shield network security director (preview)

Use network security director to understand your AWS security configuration and to explore ways to strengthen it.

https://docs.aws.amazon.com/waf/latest/developerguide/nsd-chapter.html

(Use VPN to open from Russia)

#aws

🔶 From Compromised Keys to Phishing Campaigns: Inside a Cloud Email Service Takeover

Exposed cloud credentials become the launchpad for mass phishing, highlighting email services as a prime target in cloud exploitation campaigns.

https://www.wiz.io/blog/wiz-discovers-cloud-email-abuse-campaign

#aws