TURNING AWS DOCUMENTATION INTO GOLD: AI-ASSISTED SECURITY RESEARCH

Summary from the TLDR InfoSec newsletter

This researcher attempted to discover security vulnerabilities by scraping and querying the AWS documentation. Their post begins by briefly touching on the steps taken to scrape the AWS documentation and some brief exploration locally using ripgrep. The researcher uploaded the scraped and enriched docs to s3 and set up Amazon Bedrock to query the docs using Claude 3.5. They discovered over a hundred publicly accessible buckets with sensitive information, was able to takeover a bucket, and discovered that the amzn-s3-demo-* prefix is reserved.