THE MANY WAYS TO OBTAIN CREDENTIALS IN AWS

Summary from the TLDR InfoSec newsletter

This post enumerates the many different ways that an attacker might be able to obtain credentials in an AWS environment. The AWS SDK looks for hard-coded credentials, followed by environment variables, followed by AWS credential files, and lastly IMDS. The post concludes by listing out more specialized ways that certain services can obtain credentials.