As an AWS Ambassador who's been working in AWS for 13 years, I've unfortunately encountered many cases of security failings in my customers' AWS environments. This might not be so bad, except it's always the same failings! 😡 So, let's talk about what these seemingly infinitely recurring security faux pas are, and how you can avoid being the next casualty of a failed audit... or worse.

1. FUJITSU-PUBLIC 1 © Fujitsu 2025
FUJITSU-PUBLIC © Fujitsu 2025
How to Fail
(In)gloriously
at AWS Security
Chris Bingham
CTO, Switzerland & AWS Ambassador
Webinar - 27.11.25 16:00 CET

2. FUJITSU-PUBLIC 2 © Fujitsu 2025
The 7 Recurring Sins
2nd Forgetting Permissions
Boundaries
3rd Failing to Use Hardware
Security Tokens
4th Using SMS as an
Authentication Factor
5th Overlooking Conditional
Permissions
6th Ignoring Sessions Manager
7th Forsaking Central Root
User Management
Ordered by how bored I am of talking about them!
1st Abusing Wildcards

3. FUJITSU-RESTRICTED 3 © Fujitsu 2025
FUJITSU-PUBLIC 3 © Fujitsu 2025
Ignoring
Session Manager
Let’s leave the front door unlocked!

4. FUJITSU-PUBLIC 4 © Fujitsu 2025
Introducing Session Manager
• AWS Systems Manager feature
• Log in to systems without requiring
direct network access, firewall rules, etc
• Access control via AWS IAM
• Session logging
• Port forwarding (e.g. for RDP)
• Uses SSM Agent
• Pre-installed on most EC2 AMIs

5. FUJITSU-PUBLIC 5 © Fujitsu 2025
The Sin
Leaving Session Manager usage
uncontrolled and wide open!
Allowing ssm:*
+
Not managing the SSM Agent state & config
=
Everyone has root on your OS

6. FUJITSU-PUBLIC 6 © Fujitsu 2025
The Resolution
Manage your Session Manager!
• Grant ssm: action permissions selectively
• Always explicitly define and monitor your SSM Agent config
• Even if you think you’re not using it
• Adopt Session Manager
• Avoid the issues of direct SSH and RDP connections
• Get actual audit trails of admin activity
• Simplify your AWS networking and security setup

7. FUJITSU-RESTRICTED 7 © Fujitsu 2025
FUJITSU-PUBLIC 7 © Fujitsu 2025
Overlooking
Conditional Permissions
Making life easier for the attackers!

8. FUJITSU-PUBLIC 8 © Fujitsu 2025
Introducing Conditional Permissions
• AWS IAM feature
• Used in IAM policies
• Define permissions limited by dynamic
properties
• Common examples:
• Did the principal login with MFA?
• What AWS Organization is the principal from?
• What AWS Organization is the resource in?
• Which AWS region is the request targeting?
• What tags are applied to the resource?

9. FUJITSU-PUBLIC 9 © Fujitsu 2025
The Sin
Not using conditions to limit
permissions
Failing to leverage conditions for sensitive permission grants
=
Overly complex or excessive permissions
=
Cracks which hackers will slip through

10. FUJITSU-PUBLIC 10 © Fujitsu 2025
The Resolution
Limit permission grants with
conditions!
• Make highly sensitive actions conditional on MFA
• E.g. those affecting CloudTrail, Flow Logs, etc
• Use tag conditions to simplify resource definitions
• Use AWS Organizations conditions to guard against
common attack classes
• E.g. bucket snipping, confused deputy

11. FUJITSU-RESTRICTED 11 © Fujitsu 2025
FUJITSU-PUBLIC 11 © Fujitsu 2025
Forgetting
Permissions Boundaries
Because privilege escalation = fun!

12. FUJITSU-PUBLIC 12 © Fujitsu 2025
Introducing Permissions Boundaries
• AWS IAM feature
• Used with IAM roles or users
• Defines the maximum permissions a role or
user can have…
• ... or pass to another IAM entity
• E.g. when creating an IAM role

13. FUJITSU-PUBLIC 13 © Fujitsu 2025
The Sin
Not configuring permissions
boundaries on roles and users!
No permissions boundaries
+
Permissions to create / edit / pass IAM roles
=
Quick & easy privilege escalation

14. FUJITSU-PUBLIC 14 © Fujitsu 2025
The Resolution
Centrally define and consistently set
permissions boundaries
• Define a standard set of permissions boundaries for your AWS
Organization
• Set a permissions boundary on every IAM principal
• Because there’s no reason not to, and every reason to
• Use AWS Config to detect and auto-remediate
IAM roles or users without permissions boundaries

15. FUJITSU-RESTRICTED 15 © Fujitsu 2025
FUJITSU-PUBLIC 15 © Fujitsu 2025
Connect with us via
https://bit.ly/40euORy
We’re happy to help!

16. FUJITSU-RESTRICTED 16 © Fujitsu 2025
FUJITSU-PUBLIC © Fujitsu 2025
Thanks for
your time