This document discusses how to infiltrate an AWS cloud environment through publicly exposed services like Elastic Container Registry (ECR), Systems Manager (SSM) documents, Elastic Block Store (EBS) snapshots, Relational Database Service (RDS) snapshots, and Amazon Machine Images (AMI). It outlines attack flows showing how an attacker could access credentials, source code, personal information and other sensitive data from these publicly shared resources. The document recommends mitigation steps like encrypting shared resources, frequent credential rotation, using least privilege access, inventorying all resources, and proper Identity and Access Management (IAM) configuration.

1. Infiltrate Into Your AWS Cloud Environment
Through Publicly Exposed Service
Muh. Fani Akbar
@mf.akbar127
🌧 🌧 🌧

2. Hello, Guys 👋
2
🦁 Muh. Fani Akbar (better known as rhama)
🏫 Computer Engineering at AMIKOM Yogyakarta
🏢 Cyber Security Engineer at

3. 🦁 Cloud provider
🦁 Provide 200+ services for a wide range of
technologies, industries, and use cases.

4. Master of Cloud Security
4
Mbak Rara, Cloud Engineer at MotoGP Mandalika

5. 5

6. 6
Source : @LetsDefendIO

7. Shared Responsibility
7

8. Outline
- Elastic Container Registry (ECR)
- SSM Document
- Elastic Block Storage (EBS) Snapshot
- Relational Database Service (RDS) Snapshot
- Amazon Machine Image (AMI)

9. Treasure in Publicly Exposed Service
9
🔑 Cloud credentials
🔑 Database credentials
🔑 SSH Private Keys
🔑 Application Source Code
🔑 PII (Email, DOB, Password)

10. Elastic Container Registry
(ECR)

11. 11
🐳 managed container image registry
🐳 you can push and pull Docker image
🐳 Support private and public image
registry

12. Public ECR Gallery
12

13. Public ECR Attack Flow

14. ECR Attack Flow
14
App Secret key & AWS Creds

15. System Manager (SSM)
Document

16. 16
⚒ manage apps and infra
⚒ automate operational task

17. Public SSM Document
17

18. Public SSM Document
Attack Flow

19. ECR Attack Flow
19

20. 20
Slack Webhook & AWS
Creds

21. Elastic Block Store (EBS)
Snapshots

22. 22
💾 system storage for EC2
💾 Support private and public snapshot

23. Public EBS Snapshot
23

24. Public EBS Snapshot
Attack Flow

25. EBS Snapshot Attack Flow
25

26. EBS Snapshot Attack Flow
26
DB Creds

27. Relational Database Service (RDS)
Snapshots

28. 28
📚 Managed Database service
📚 Support private and public snapshot

29. Public RDS Snapshot
29

30. Public RDS Snapshot
Attack Flow

31. RDS Snapshot Attack Flow
31

32. RDS Snapshot Attack Flow
32
PII

33. Amazon Machine Image (AMI)

34. 34
🥛 Master image to launch EC2
🥛 Support private and public share

35. Public AMI
35

36. Public AMI Attack Flow

37. AMI Attack Flow
37

38. AMI Attack Flow
38
AWS Creds
SSH Private Key

39. Recap On Publicly Exposed
💾 EBS Snapshot
📚 RDS Snapshot
🏀 AMI (Amazon Machine Images)
🎫 SSM Document
🧶 ECR (Elastic Container Registry)

40. More …
A.k.a be more Evil

41. What if we can put a backdoor/malware
👿 ?

42. Mitigation

43. Mitigation
43
🛡 Encrypt every shared-resource
🛡 Rotate credentials frequently
🛡 Least privilege is a must
🛡 Inventory everything
🛡 IAM is the key

44. Thank You