THE CAT FLAP - HOW TO REALLY PURRSIST IN AWS ACCOUNTS

Summary from the TLDR InfoSec newsletter

This post describes a method for obtaining backdoor persistence in AWS by modifying the AWSControlTowerExecution role to allow an attacker-controlled account to assume it. The attack is effective because many tools will not flag violations against this role, which contains AdministratorAccess by default. There are likely other AWS service roles that this attack could utilize.