HOW AWS USES ACTIVE DEFENSE TO HELP PROTECT CUSTOMERS FROM SECURITY THREATS

Summary from the TLDR InfoSec newsletter

AWS' active defense tool, Sonaris, works in conjunction with MadPot honeypot sensors to uncover new techniques that attackers are using to attack customer accounts (such as enumerating S3 buckets or vulnerable EC2 services) and attempts to proactively respond to them using other AWS services such as WAF, VPC, and AWS Shield. Its use led to an 83% reduction in abuse in MadPot tests. It was able to prevent more than 16k scanning attempts per hour during a Dota3 campaign in Q3 2024.