When Moving To the Cloud, Don’t Leave Basic Security Behind

Executive summary: The report reviews TestLabs' demonstration of breaking into an AWS serverless application by exploiting an unvalidated API Gateway and event data injection to run commands that exposed environment variables, AWS access keys, and session tokens; attackers were then able to download S3 and DynamoDB contents due to excessive privileges and public buckets, and also perform a denial-of-service by exhausting Lambda concurrency. The piece emphasizes shared responsibility in AWS, the need for input validation, least-privilege access, logging/monitoring, network controls, and recommends proactive testing (e.g., hacker-powered security) to find and remediate such issues.