AWS Security Flaw: Dangerous Consequences of Leaked Keys
Critical gaps in AWS's quarantine policy for leaked root keys.
1AWS Key Leak Crisis
Research by Truffle Security revealed that hundreds of AWS root keys were leaked in public GitHub repositories and remain active. AWS's automated quarantine policy detects leaked credentials but fails to fully prevent malicious actions. This creates a critical security vulnerability, especially for root keys.
2Gaps in Quarantine Policy
AWS's quarantine policy does not block certain actions to avoid disrupting customer environments. For example, malicious users can perform any operation on RDS, execute root commands on EC2 instances, and assume roles in other accounts. These gaps allow significant damage to systems.
3Data Manipulation Risks
Leaked keys enable users to fill S3 buckets to petabytes, set object lock and compliance retention modes. These settings are irreversible except by deleting the entire account. Additionally, deleting CloudFormation stacks and backups is possible, increasing data loss risks.
4Access to Secret Data
The quarantine policy does not block critical actions like secretsmanager:GetSecretValue and kms:Decrypt. This allows malicious users to access encrypted data and sensitive information. AWS must urgently address these vulnerabilities.
5SES and SNS Vulnerabilities
Critical flaws exist in AWS Simple Email Service (SES) and Simple Notification Service (SNS). Malicious users can abuse email sending permissions to spread spam or send fraudulent SMS messages. These vulnerabilities can severely damage brand reputation.
6Deletion of Audit Logs
Permissions to stop and delete CloudTrail audit logs allow malicious users to cover their tracks. This makes it harder to detect attacks and conduct retrospective investigations. AWS must also block these actions.
7Risk of Customer Environment Disruption
AWS keeps its quarantine policy lenient to avoid disrupting customer environments. However, this approach enables malicious users to cause greater damage. AWS needs to strike a better balance between security and usability.
8AWS Must Take Urgent Action
These security flaws highlight the need for AWS to review its quarantine policy. The scope of actions malicious users can take poses a serious threat to customer data and business continuity. AWS must act quickly and effectively to close these gaps.