CLOUDTRAIL LOGGING EVASION: WHERE POLICY SIZE MATTERS

Summary from the TLDR InfoSec newsletter

Researchers from Permiso Security discovered a novel CloudTrail log bypass that abuses differing policy size calculations. AWS' documentation states that whitespace does not count when determining the maximum size of an IAM policy. However, the researchers determined that the policy would fail validation if the whitespace caused the size to exceed 131,072 characters. The researchers discovered that CloudTrail fails to capture full request details for requests in the size range of 102,401 to 131,072.