BREACHING THE DATA PERIMETER: CLOUDTRAIL AS A MECHANISM IN DATA EXFILTRATION

Summary from the TLDR InfoSec newsletter

AWS CloudTrail's behavior with VPC Endpoints allowed data exfiltration through denied cross-account requests. Exploiting the vulnerability requires creating a DynamoDB table with specific resource policies and using custom user-agents to smuggle data through CloudTrail logs. While now patched, the vulnerability demonstrates how CloudTrail's inconsistent logging behavior across services can be exploited for data exfiltration.