3 ms·
The most important part of this story seems to be glossed over – how did an IAM key that the author insists only had access to the Alexa service get used to spi
by apetresc 11y ago
The most important part of this story seems to be glossed over – how did an IAM key that the author insists only had access to the Alexa service get used to spin up EC2 instances?
Either the author is just mistaken/lying about that point, or there's another leak he doesn't know about, or there's a serious privilege escalation vulnerability in AWS.
- merlincorey 11y agoSomeone else in a thread above supposes that they actually published amazon master keys, rather than an AWS particular IAM role. The author of the post states they didn't even use AWS prior, so they are most likely not aware of such things.