Hacking the Cloud on Mythryl: “A deny-all session policy can turn verbose AWS `AccessDenied` errors…”

A deny-all session policy can turn verbose AWS `AccessDenied` errors into a public-exposure oracle. If the error says the session policy blocked the request, the resource policy may have allowed it. This post breaks down the signal and the caveats.

buff.lyDetect Public Resource Exposure via Session Policy Error Messages - Hacking The CloudUse session policy denials and verbose IAM error messages to determine if AWS resources have public resource-based policies.

16/6/26, 2:08 pm0 reposts0 likes

Post