Casting Light on Shadow Cloud Deployments

Incident responders often find cloud systems that were launched informally: proofs of concept that became production, test copies sitting in dev accounts, or staff who opened an account outside any governance process. Once a service has a public IP address, it becomes an initial access point. The talk walks through a 2024 campaign against an exposed Jenkins server at a bank, where attackers exploited a file inclusion flaw, read stored credentials, and reached customer data through a supply chain path. It also covers a small company whose publicly reachable database was wiped and held for ransom.

The speakers argue that existing cloud posture tools focus on long-term configuration, while responders need fast answers about which resources are affected, who owns them, how long they were exposed, which services are involved, and whether the problem is isolated. They present Luminant, an open tool that starts from AWS network interfaces with public addresses and works outward to security groups, instances and load balancers. It pulls CloudTrail and AWS Config history for context and checks what the internet can see using Nmap and Shodan. A live demo showed permissive rules, a change timeline and a fingerprinted Grafana version.

The main takeaways are to validate scanner findings, since IP addresses get recycled, and to use allow lists and tag-based exclusions to cut noise. Output is available in terminal, HTML, JSON and CSV timeline formats. The tool runs in Docker and needs read-only AWS permissions, and the speakers urge attendees to review the code before running it in their own environments.