Security

Even in shops that live by infrastructure as code, someone eventually opens the AWS Console and clicks. A quick fix during an incident, a security group tweak, a “temporary” instance. That is ClickOps, and it is how drift and silent risk creep into an otherwise clean account. I built ClickOps Sentinel at zoph.io to catch those moments and, more importantly, to tell me what they actually mean. Detecting console changes Detection relies on the CloudTrail sessionCredentialFromConsole flag, which AWS sets server-side for every API call made with console session credentials. No user-agent guessing, no CloudTrail trail to create, no S3 log parsing. ...

The 46-Minute Problem The IAMTrail detection engine (originally MAMIP) fetches ~1,500 AWS managed IAM policies every run. The original approach was pure bash: 1 2 3 4 aws iam list-policies --output json | jq -cr '...' | xargs -P 16 -n3 sh -c \ 'aws iam get-policy-version --policy-arn $1 --version-id $2 | jq --indent 4 . > "policies/$3"' sh Looks fine, right? Except each iteration spawns a full AWS CLI process. That means a fresh Python runtime, boto3 import, credential resolution, one single HTTP call, then exit. Times 1,500. ...

📜 The Origins Back in 2019, Scott Piper started a GitHub repository to track changes to AWS Managed Policies. It was a simple setup, manually triggered but it worked well and was incredibly useful. Using git diff or the Github.com UI, Scott and the community could easily see how policies evolved over time. At that time, AWS didn’t publicly share the changes made to managed policies by the various “two-pizza” product teams inside AWS. ...

✨ Introduction It starts with an innocuous-looking email. The sender claims to be AWS Support, warning the recipient about an urgent security issue. A single button labeled “Launch Stack” is prominently placed, urging immediate action. What appears to be a standard security advisory is, in reality, the gateway to a sophisticated AWS account takeover attempt. Threat actors are exploiting AWS CloudFormation StackSets in phishing campaigns designed to compromise AWS environments. Originally reported by Rami McCarthy back in 2022 and by Scott Piper in this blog post (2021), this technique continues to evolve, demonstrating how adversaries leverage AWS automation against its own users. ...

📜 History In late 2020, I was floored by the number of announcements, changes, re:Invent releases, and blog posts that AWS pushes every week. Then, I decided to automate part of my weekly routine to stay up to date. The idea was to get a digest email summary of what was going on. It was very helpful for my job as an Indie AWS Security Consultant. A few weeks later, I decided to open my weekly digest to external subscribers, as I believed it could interest folks in the same field. Here we were with the ASD Newsletter in January 2021. ...