Lateral Movement and other Creative Steps Attackers Take in AWS

The talk starts by contrasting cloud and on-premises networks. In AWS, workloads sit in the data plane while the API-driven control plane manages resources, and an attacker often has to cross both. Classic on-prem tactics such as ARP discovery do not work inside VPCs, so the speaker describes alternatives: scanning address ranges, pivoting from a compromised instance through its attached role, and using stolen keys to call APIs directly.

The middle section covers movement between accounts. Trust policies that let one account assume a role in another can be chained, and the speaker shows how bouncing between control-plane role assumptions and data-plane instances can get around session limits. Account IDs and role names, often guessable or exposed in logs and policies, make this easier. The talk also reviews IAM privilege escalation techniques, noting that they differ in how quickly they reach administrator access, and points to a policy analysis tool for finding them. Common designs such as hub-and-spoke networking, shared CI/CD accounts and an AWS Organizations management account are presented as risky.

To close, the speaker presents a prototype graph tool that loads account and resource data into a graph database and visualises likely lateral movement and escalation paths, demonstrated on mock-up client data. Practical takeaways include applying least privilege with permission boundaries and service control policies, keeping the management account empty, reviewing cross-account trust, and segmenting accounts and networks.