A CLOSED NETWORK PATH IS NOT A CLOSED EXECUTION PATH

Summary from the TLDR InfoSec newsletter

When working with event-driven architectures, traditional network paths, such as security groups, firewalls, and network ACLs, may not be the same as the execution path. The author tested this by creating a cross-account EventBridge policy which allowed an external account to send events to an internal account which triggered a Lambda function, which then called an EKS application that used its cloud identity to perform a privileged action. Since each individual action was legitimate, no alerts or detections fired. It took the author a full afternoon to trace the events even though he knew the full path.