Stormy Skies - Modern Cloud Attacks and their Countermeasures

This talk focuses on cloud attacks seen in the field, mostly against AWS, with the view that most lessons carry over to Azure and other providers. It argues that rapid deployment, serverless functions and container workloads without operating system access have changed how attacks unfold and how defenders need to watch for them. Credential theft is presented as the dominant entry point, with leaked keys in public repositories, stolen single sign-on sessions, and pivots from on-premises directory services into cloud administration all appearing in real engagements.

The middle section walks through composite attack paths drawn from client work. One shows how found access keys can be tied to an owning account and an identity while limiting log noise, and how service-linked role names hint at which services are running. Another follows a malicious merge request that triggers code during an infrastructure-as-code plan step, exposing deployment credentials with administrative reach. Detection gaps are covered too: cloud-native threat services catch obvious tooling but are easy to bypass, so control plane audit logs and service-specific logs should be enabled first.

The closing part lists controls: multi-factor authentication, least privilege on key resources, short-lived credentials instead of long-lived keys, separate accounts per environment, restricted shared services such as central build servers, and regular secret scanning. The main takeaway is to treat CI/CD pipelines and source code platforms as core parts of the security model rather than supporting tools.