🔍 AWS cross-account trust Roles abused in powerful cloud breach attacks that used IAM credentials associated with Qubole's AWS account to access multi-tenant environments from October 14th to 26th. The researchers said that the actor assumed cross-dormant roles, assigned S3 access, extracted secrets from SSM and the SSM Parameter Store manager, read the Lambda environment variable, confirmed the credentials with TrauffleHog, and exfiltrated data from accessible buckets. Qubole - Dodgy roles were the entry point. The case highlights the risk of third-party trust relationships. AWS was not hacked, but inherited access from an external vendor that exposed the downstream tenants at scale. 🛰️ Open sources - closed narratives.

🔍 AWS cross-account trust Roles abused in powerful cloud breach attacks that used IAM credentials associated with Qubole's AWS account to access multi-tenant environments from October 14th to 26th. The researchers said that the actor assumed cross-dormant roles, assigned S3 access, extracted secrets from SSM and the SSM Parameter Store manager, read the Lambda environment variable, confirmed the credentials with TrauffleHog, and exfiltrated data from accessible buckets. Qubole - Dodgy roles were the entry point. The case highlights the risk of third-party trust relationships. AWS was not hacked, but inherited access from an external vendor that exposed the downstream tenants at scale. 🛰️ Open sources - closed narratives.