Shadow Roles: AWS Defaults Can Open the Door to Service Takeover

What if the biggest risk to your cloud environment wasn’t a misconfiguration you made, but one baked into the defaults?
Our research uncovered security concerns in the deployment of resources within a few AWS services, specifically in the default AWS service roles. These roles, often created automatically or recommended during setup, grant overly broad permissions, such as full S3 access. These default roles silently introduce attack paths that allow privilege escalation, cross-service access, and even potential account compromise.
Yakir Kadkoda
Yakir Kadkoda is a Lead Security Researcher at Aqua's research team, Team Nautilus. He combines his expertise in vulnerability research with a focus on discovering and analyzing new security threats and attack vectors in cloud native environments, supply chain security, and CI/CD processes. Prior to joining Aqua, Yakir worked as a red teamer. Yakir has shared his deep cybersecurity insights at major industry events like Black Hat and RSA.

Facts Only

Who: Yakir Kadkoda, Aqua's Team Nautilus
What: Identified security concerns in the default AWS service roles
When: Presented at major industry events like Black Hat and RSA

Executive Summary

Researchers at Aqua's Team Nautilus, led by Yakir Kadkoda, have identified security concerns in the default AWS service roles. These roles, often created automatically or recommended during setup, grant overly broad permissions that could lead to privilege escalation, cross-service access, and potential account compromise. This issue was presented at major industry events like Black Hat and RSA.

Full Take

This research reveals a concerning pattern of overly broad permissions in default AWS service roles, which could silently introduce attack paths. This finding underscores the importance of reviewing and adjusting defaults in cloud environments to minimize potential security risks. By understanding these underlying issues, organizations can better protect their data and systems.
Questions for further inquiry: What other potential security risks might be introduced by default settings in cloud services? How can organizations effectively manage and mitigate these risks?
A counterstrike scan would suggest that a bad actor might leverage this information to exploit vulnerable AWS accounts, potentially leading to data breaches or service disruptions. However, the actual content does not align with this pattern as it is a research finding rather than an active attack.