intelligence_src_d11443da85ea659d49
- Source-provided label
- Publisher RSS metadata
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- May 31, 2022 00:00 UTC
- Retrieved
- Oct 14, 2026 03:41 UTC
MWAA logs leak tokens and hostnames
Two API calls used by Amazon Managed Workflows for Apache Airflow (MWAA) to convert AWS IAM credentials into tokens that can be used to login to Airflow (CreateCliToken and CreateWebLoginToken) were logging the tokens to Cloudtrail. The event included the hostname for the airflow server, so everything required to login to Airflow was in the event. However, the issue was largely mitigated by the fact that the tokens are only valid for 60 seconds and CloudTrail delivers logs on average about every 15 minutes, so the chance of receiving a valid token were low.
Reference details
- Source category
- research-report
- First reported
- May 31, 2022 00:00 UTC
- Last reported
- May 31, 2022 00:00 UTC
- Catalog updated
- Oct 14, 2026 03:41 UTC
- Record ID
e7bd9be74dcb948b383af92cd9b71c05f685bf844c268a00e98a7d6624c756cc
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Review source update dates and status
- intelligence_src_d11443da85ea659d49Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.