Breaking free from the chains of fate - Bypassing AWSCompromisedKeyQuarantineV2 Policy

AWSCompromisedKeyQuarantineV2 is an AWS policy that attaches to identities whose credentials are leaked. It denies access to certain actions, applied by the AWS team in the event that an IAM user's credentials have been compromised or exposed publicly.

The policy though, does not protect the infrastructure. Though many permissions are prevented, a lot more are allowed to be executed.
This presentation will show how an attacker can enumerate, escalate privileges, persist and even cause mayhem in a target's environment, whose credentials have been leaked online.

SANS HackFest Hollywood Summit 2024
Breaking free from the chains of fate - Bypassing AWSCompromisedKeyQuarantineV2 Policy
Bleon Proko, Cloud Security Researcher, Permiso
Andrew Kraut, Senior Researcher, Permiso