60 minutes: Hack this AWS account

The talk asks what an attacker can accomplish against an AWS account when they hold temporary credentials that expire after an hour and access may be cut sooner. The speaker structures the work around a standard penetration testing methodology, moving from information gathering through vulnerability analysis, exploitation and post-exploitation, and skips reporting for time.

Much of the session is about automation. Open-source tools such as Cloud Fox, Principal Mapper, Prowler and Pacu are used to list permissions, map role trust, find internet-facing ports, and locate secrets, CloudFormation stacks, pipeline code, container images and public EBS snapshots. Privilege escalation ideas include assuming overly trusted roles, launching instances with powerful roles, and abusing SSRF against the instance metadata service. The speaker notes that S3 object reads are not logged by default, while scanning and enumeration generate heavy CloudTrail activity.

For persistence, the speaker covers role juggling to extend session lifetime, federation tokens that outlive revoked access keys, and malicious instance user data. The closing advice is to build a time-boxed operation around a prioritized checklist, let each step feed the next, and expect defenders to see the noise these tools create.