EC2 PRIVILEGE ESCALATION THROUGH USER DATA

Summary from the TLDR InfoSec newsletter

This post enumerates methods for escalating privileges on EC2 instances to root/System by modifying the instance’s user data. An attacker can create a new user data script if an instance has the ec2:ModifyInstanceAttribute permissions, replace the old user data with it, and restart the instance. The post covers a method that can be used if the EC2 instance pulls user data scripts or artifacts from S3 and has permissions to modify those buckets.