Attributed metadata history
Up to 100 retained publisher events per page for e1ff99ff56c830794b0bdade4eb4c179a311a9ec800423a2a6dbf247b6996f4e. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:04 UTC
CloudFormation allows the use of Lambda-backed resource providers, wherein Lambda can be used to write custom provisioning logic to be executed during CloudFormation stack operations. The aforementioned Lambda functions were executed in an AWS-managed account (thus effectively allowing arbitrary code execution in that account), and were passed a set of credentials ("platformCredentials") for a role in this account that had several EventBridge permissions. These were sufficient for an attacker to create new rules in the AWS-managed account that leaked credentials belonging to other users of resource providers. For example, creating a rule that matched events with {"detail-type": ["AWS API Call via CloudTrail"]} exposed records of other tenants' API calls, which included copies of credentials for roles in other tenants' accounts.
Fingerprint: e4240966253181f0b4e72830124d209b2bd6a0dd25cab5773e4865cb343af6d1
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
available
Fingerprint: 46fd50ac705e064c7517d97d61b5ec511c9b1ada6209622159dd39573ba08e5c