NON-PRODUCTION ENDPOINTS AS AN ATTACK SURFACE IN AWS

Summary from the TLDR InfoSec newsletter

The Datadog Security team discovered a new method for AWS privilege enumeration that can bypass CloudTrail logging. The method involves querying ce:GetCostAndUsage and route53resolver:ListFirewallConfigs for access to various other resources. The AWS team has fixed the specific bypasses and worked with the Datadog team to identify additional potential attack vectors.