AWS Security makes an inscrutable choice

One of the best ways to lower your AWS bill by 99 percent or more is by not checking your keys into public GitHub repositories.

Many of us have done this inadvertently over the years, and the defenses against it have improved dramatically (my personal favorite being "using non-ephemeral credentials derived from OIDC or SSO is an anti-pattern"), but it still happens.

On Friday, BleepingComputer reported on a Truffle Security finding that hundreds of leaked AWS keys are root keys and are somehow still active and valid.

AWS Security is full of very smart people who care deeply about a number of things, including "not abetting crime." If they detect (usually via automated means) that a credential has been leaked, they're quick to apply a Quarantine Policy to it.

Trouble is, that policy enumerates a bunch of bad behaviors in an ever-expanding graph of principals and associated behaviors.

AWS' considered position on this is that they don't want to break customer environments: "The policy aims to limit the potential damage that may be caused by fraud-related activity leading to unauthorized charges, while not impacting the existing resources." AWS' considered position on this is wrong.

If I get access to your credentials (much less a root credential, good god), deactivating them may very well break your workload because anything that relies on those credentials will start failing.

Until you rotate them, those workloads will continue to fail.

That's not good! But I promise you, as a bad actor, I can do far worse to you.

Hold my tea Go ahead and apply a quarantine policy to a credential set and toss it my way.

I won't be able to buy savings plans, read your S3 data, modify Lambda functions, and do a host of other things.

But here's what I can do.

Anything I damn well feel like on RDS.

You don't have anything important in databases, right? ssm:SendCommand / ssm:StartSession are permitted, which means I can run commands as root on EC2 instances, which will in turn invoke with that instance role’s permissions. sts:AssumeRole means that I can assume any other role in the account and get its permissions, rendering the entire restriction list potentially moot.