May Recap: New AWS Privileged Permissions and Services

The report catalogs newly released AWS permissions from May that introduce high-risk capabilities across compute, genomics, container orchestration, and external AI platforms. It emphasizes an "Infrastructure Hijacking" pattern—permissions that allow attackers to extend or replace legitimate infrastructure (notably ECS daemon lifecycle actions that enable cluster-wide workload injection and evidence removal) or permanently destroy workspace-scoped resources—urging strict least-privilege controls to prevent combined permissions from coexisting in a single identity.