3 ms·
Nothing. The problem here was not the waf, but the credential/role being compromised.
by akamai 7y ago
Nothing. The problem here was not the waf, but the credential/role being compromised.
- ownagefool 7y agoApparently it was both. The WAF was used to SSRF the metadata service which would have exposed the role. Why a WAF role needed so much access to data is something that's hard to explain, and would suggest a major fuckup by the teams involved.