/tags/mistake/ Recent content in Mistake on zoph.me https://zoph.me/posts/resources/images/code-social.png https://zoph.me/posts/resources/images/code-social.png Hugo -- 0.148.2 en-us Wed, 22 Dec 2021 13:37:00 +0200 /posts/2021-12-22-the-day-when-aws-support-got-access-to-your-data/ Wed, 22 Dec 2021 13:37:00 +0200 /posts/2021-12-22-the-day-when-aws-support-got-access-to-your-data/ <blockquote> <p>Update from: 2021-12-23</p> <p>Official Security bulletin from AWS AWSSupportServiceRolePolicy Informational Update</p> <p><a href="https://aws.amazon.com/security/security-bulletins/AWS-2021-007/">https://aws.amazon.com/security/security-bulletins/AWS-2021-007/</a></p></blockquote> <p>You will find below details about the security incident that led to this unattended access for millions of AWS customers.</p> <p>On <code>22nd December 2021</code>, AWS deployed a new version (<code>v20</code>) of <code>AWSSupportServiceRolePolicy</code>, used by a mandatory role <code>AWSServiceRoleForSupport</code> for AWS Support access to all AWS Accounts. In this policy, they added the action <code>s3:getObject</code>, which gives AWS Support teams access to all customer Amazon S3 data.</p>