PRIVILEGE ESCALATION WITH SAGEMAKER AND THERE'S MORE HIDING IN EXECUTION ROLES

Summary from the TLDR InfoSec newsletter

Privilege escalation flaws have been discovered in AWS SageMaker. Attackers with specific permissions can inject malicious code via lifecycle configurations, mimicking EC2 user data escalation and affecting Lambda and CloudFormation. It is important to detect stop-modify-start sequences in CloudTrail and implement strict access controls.