🔶 Investigating Persistence Mechanisms in AWS

Rapid7 Labs details four AWS persistence techniques used by attackers: rogue IAM user creation, backdoored assume role policies granting external account access, malicious Lambda functions provisioning privileged users, and federated user sessions that survive key rotation. Includes LEQL detection queries and remediation steps.

https://www.rapid7.com/blog/post/dr-investigating-aws-persistence-mechanisms

#aws

🔶 HIPAA Security Rule on AWS

AWS released a whitepaper guiding covered entities and business associates on implementing HIPAA Security Rule Technical Safeguards on AWS, covering access control, audit, MFA, encryption, and 2025 NPRM proposed changes, with shared responsibility mapping and ePHI architecture guidance.

https://aws.amazon.com/ru/blogs/security/hipaa-security-rule-on-aws-technical-safeguards-implementation-and-readiness-guidance

#aws

🔶 How AWS IAM role manager rethinks the starting point for IAM roles

AWS IAM role manager automates IAM role creation within supported service consoles, eliminating manual role setup. Using managed role templates and a new AcquireRole API, it provisions and attaches least-privilege roles automatically. Roles remain fully customer-controlled and refinable via IAM Access Analyzer.

https://aws.amazon.com/ru/blogs/security/how-aws-iam-role-manager-rethinks-the-starting-point-for-iam-roles

#aws

🔶 A few notes on AWS Nitro Enclaves: KMS integration

This third installment in Trail of Bits' Nitro Enclaves series catalogs passive and active attack classes against enclave-KMS communication, covering CMK substitution, data key swapping, replay attacks, policy misconfigurations, key commitment gaps, and operational risks.

https://blog.trailofbits.com/2026/08/05/a-few-notes-on-aws-nitro-enclaves-kms-integration

#aws

⚠️ Going depthfirst: Achieving GitLab RCE via Two Ruby Memory. Corruption Vulnerabilities

Researchers chained two memory-safety flaws in Oj, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.

https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities

#RCE

🔶 Threat hunt AI: How we built an AI security analyst on AWS for under $500/month

Grow Therapy built a Claude-powered threat hunting system on ECS Fargate and Lambda, querying Snowflake and Datadog logs across 15 sources. A five-phase AI pipeline (data gathering, baseline comparison, enrichment, confidence scoring, adversarial validation) reduces false positives. Total cost: under $500/month.

https://engineering.growtherapy.com/post/threat-hunt-ai-how-we-built-an-ai-security-analyst-on-aws-for-under-500-month

#aws

🔶 Implement custom authentication for tools integration using request Lambda interceptor in AgentCore Gateway

AgentCore Gateway supports OAuth 2.0, IAM, and API keys natively, but a request Lambda interceptor enables legacy Basic Auth integration. The interceptor validates the inbound JWT, retrieves system credentials from Secrets Manager, and constructs the Basic Auth header before forwarding to the downstream tool.

https://aws.amazon.com/ru/blogs/security/implement-custom-authentication-for-tools-integration-using-request-lambda-interceptor-in-agentcore-gateway

#aws