AWS Tabletop Scenarios @AWSscenarios

Inspired by @badthingsdaily. This account tweets fictional or headline inspired breach scenarios relating to the AWS cloud. us-east-0 Joined September 2022

Tweets

22
Followers

33
Following

0
Likes

0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

AWS has announced a new service at re:Invent that replicates your entire business, at a tenth of the price.

0 0 1 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

An AWS Control Tower upgrade has broken your production application.

Alexandre Sieira @AlexandreSieira

3 years ago

An AWS Control Tower upgrade has broken your production application.

1 0 1 0 0

Download Image

0 0 2 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

Your cloud traffic is being sporadically dropped and no-one knows why.

What's New on AWS (Unofficial) @awswhatsnew

3 years ago

Your cloud traffic is being sporadically dropped and no-one knows why.

0 17 33 0 3

0 0 1 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

Your outbound web proxy provided access to internal secrets by GET request.

What's New on AWS (Unofficial) @awswhatsnew

3 years ago

Your outbound web proxy provided access to internal secrets by GET request.

0 45 137 0 9

0 0 0 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

IAM has failed open allowing all requests to succeed, regardless of policies. hasIAMfailedopenyet.com

0 0 0 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

You press the submit button.

0 0 0 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

Control Tower has decided to log its own logs and the resulting AWS bill exceeds the total value of your business.

Will Dady @WillDady

3 years ago

Control Tower has decided to log its own logs and the resulting AWS bill exceeds the total value of your business.

3 0 9 0 1

Download Image

0 0 1 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

Your Kinesis Firehose has been compromised because you didn't realize the Kinesis Firehose service uses an unusual technique involving the sts:ExternalId condition for prevention of the confused deputy problem.

0 0 0 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

Your non-VPC AWS Lambda functions suddenly cannot resolve *.amazonaws.com endpoints. There seems to be no way to debug why.

0 0 0 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

Your region is being impacted by a hurricane. Your disaster recovery plan involves key staff members currently impacted by said hurricane.

0 0 1 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

An engineer has accidentally deleted all CodeCommit repositories and there seems to be no local copies. Pipelines have started failing.

0 0 0 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

A very public, detailed breakdown of your AWS bill is being done by @QuinnyPig, much to your and your CFO's surprise.

0 0 1 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

There is a production issue with your CDK-deployed application, however your engineering team doesn't understand how to debug the resulting CloudFormation stack.

0 0 0 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

Your core infrastructure IaC has been placed into a public GitHub repository, and includes embedded key pairs and secrets. The repository owner is not known.

0 0 0 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

Other customers can arbitrarily attach your EBS volumes to their own instances.

0 0 0 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

The credit card on your management account has expired and only the CEO has root access. They are currently on an extended vacation and uncontactable.

0 0 1 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

Someone has figured out how to create SigV4 signed requests that tricks IAM into thinking it came from another accounts identity. They post their PoC on a reddit thread asking others to confirm.

0 0 0 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

All of the PII documents of your customers have been leaked because your cloud engineer fundamentally misunderstood the "Authenticated Users" S3 ACL.

0 0 1 0 0

AWS Tabletop Scenarios @AWSscenarios

3 years ago

Your organisation secrets were stolen using PAM credentials that were found in a PowerShell script on a network drive, including the AWS root account credentials.