USING AWS CERTIFICATE MANAGER AS A COVERT EXFILTRATION MECHANISM

Summary from the TLDR InfoSec newsletter

AWS Certificate Manager (ACM) does not offer VPC endpoints, so any cloud resources that want to utilize it must have access to the service. An attacker can also connect an instance to ACM in the attacker's account and use the nsComments field to exfiltrate free-form data. The post concludes with an exploration of other AWS services that can be used in this way, such as SAML provider metadata and Lambda functions.