TALES FROM THE CLOUD TRENCHES: RAIDING FOR AWS VAULTS, BUCKETS, AND SECRETS

Summary from the TLDR InfoSec newsletter

This blog post examines behavior from an attacker that Datadog saw in several customer environments. The attacker probed for S3 buckets and AWS Secrets Manager secrets, which is common but also, less commonly, probed for Glacier vaults. In all cases, the attacker did not take follow on actions. The attacker also signed their AWS API requests manually as opposed to using a library such as boto3, which handles signing.