How AWS Services Provide Credentials—and Where Attackers May Find Them
Summary
An overview of how AWS services provide IAM credentials through SDK providers, metadata services, containers, Systems Manager, IoT, IAM Roles Anywhere, Cognito and DataSync—knowledge defenders can use to understand credential-access paths.
Key points
- AWS SDKs can obtain credentials from code, environment variables, standard credential files, or instance metadata.
- EC2 and Lightsail use the Instance Metadata Service; IMDSv2 changed the request flow, and the service is also reachable over IPv6.
- ECS, EKS and other services expose credentials through container credential endpoints or environment variables; EKS Pod Identities and IRSA use distinct mechanisms.
- Systems Manager Default Host Management Configuration can provide an EC2 with an additional IAM role; obtaining its credentials involves a key pair stored by the SSM agent.
- SSM hybrid activation stores registration material in files that can be used to obtain credentials; the agent may also store credentials locally.
- AWS IoT and IAM Roles Anywhere support credential access from non-AWS environments using certificates; Roles Anywhere can use PKCS#11 modules.
- The article also describes credential access through Cognito and a DataSync mechanism using certificate and key files.
Article Details
- Topic
- Methods AWS services use to provide IAM role credentials, and locations attackers may inspect to obtain them
MITRE ATT&CK
People
Vendors
Products
Amazon CognitoCognito is a service for customer identity and access management. It offers an API called GetCredentialsForIdentity which is passed an identity ID, which is just a region and GUID value, and will return AWS sessionAmazon Lightsailheader), to improve it. That magic host can also be accessed by IPv6 via the address [fd00:ec2::254]. LightSail supports this same mechanism for obtaining role credentials. App RunnerThat same technique also works for SageMaker Notebooks, App Runner, CodeBuild, and Batch. Nick Jones documented much of this and more in his blog post AWS Access Keys -AWS CodeBuildThat same technique also works for SageMaker Notebooks, App Runner, CodeBuild, and Batch. Nick Jones documented much of this and more in his blog post AWS Access Keys - A Reference. AWS LambdaAWS Lambda, which was released in 2014 for serverless execution, puts the IAM role session credentials in the environment variables by using the variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKENAWS Systems ManagerAWS Systems Manager (SSM) includes functionality for an agent to run on your compute resources that can then manage them by doing things like downloading and executing scripts. Customers may find it useful for the agentBatchThat same technique also works for SageMaker Notebooks, App Runner, CodeBuild, and Batch. Nick Jones documented much of this and more in his blog post AWS Access Keys - A Reference. CloudShellcan also be found through the environment variable AWS_CONTAINER_CREDENTIALS_FULL_URI which is used by CloudShell and IoT Greengrass 2.0 to reach a service running on localhost and also requires setting the HTTPDataSyncDatasync is an AWS service for keeping two storage locations in-sync, such as ensuring that an S3 bucket has the same files as a local directory on a server. Although it does not appear to obtain IAM role credentials,EC2Prior to the release of IAM roles in 2012, EC2 user-data (http://169.254.169.254/latest/user-data) was sometimes used to store credentials, and these were often set as environment variables before use.ECSContainer services on AWS, such as ECS and EKS, use the environment variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI along with the IP address 169.254.170.2 to perform an HTTP GET to a URL such asEKSContainer services on AWS, such as ECS and EKS, use the environment variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI along with the IP address 169.254.170.2 to perform an HTTP GET to a URL such asIoT Greengrassthrough the environment variable AWS_CONTAINER_CREDENTIALS_FULL_URI which is used by CloudShell and IoT Greengrass 2.0 to reach a service running on localhost and also requires setting the HTTP header AuthorizationSageMaker NotebooksThat same technique also works for SageMaker Notebooks, App Runner, CodeBuild, and Batch. Nick Jones documented much of this and more in his blog post