AWS Security Digest·Week 26 of 2026·Jun 22-28, 2026·7 items
GuardDuty Learns to Investigate, Sign-In Learns to Say No
GuardDuty previews AI-powered investigations, and AWS Sign-In gains resource-based policies plus RCPs that lock console access to expected networks. Researchers deliver a triple hit: Unit 42's universal bucket hijacking, a targeted AWS-console phishing kit that handles MFA, and Wiz's disclosure of an Amazon Q Developer flaw that leaked AWS credentials on repo open.
In this issue5high2medium
Highlights
4 items
$ tail -f /var/log/aws-security.log
high/Feature Launch/
GuardDuty Previews AI-Powered Investigations
Amazon GuardDuty introduced AI-powered investigations in preview on June 23. The capability automatically analyzes findings, examining finding context, related activity from the last 90 days, affected resources, and threat indicators.
Output includes a disposition assessment with confidence scoring, MITRE ATT&CK technique classification, supporting evidence, and recommendations for suppression, containment, or remediation. It is available via console, CLI, API, or AWS's MCP Server in 10 Regions: N. Virginia, Ohio, Oregon, Canada Central, Ireland, London, Frankfurt, Paris, Stockholm, and Tokyo.
Automated triage with confidence scoring attacks the real SOC problem: alert fatigue and slow time-to-disposition.
GuardDuty
high/Feature Launch/
AWS Sign-In Gains Resource-Based Policies and RCPs to Lock Console Access to Expected Networks
AWS Sign-In now supports resource-based policies and Organizations resource control policies (RCPs) that restrict AWS Management Console sign-in and aws login CLI sessions to expected networks: corporate IP ranges, on-premises networks, or VPC endpoints.
Enforcement works at single-account level or across an organization, OU, or account. Sign-in attempts are logged in CloudTrail. Available in all commercial Regions at no additional charge.
This closes a long-standing data-perimeter gap: stolen credentials become unusable from outside approved networks, at the sign-in layer itself.
IAMOrganizationsCloudTrail
high/Threat Intel/
Unit 42: Deleted Bucket Names Can Be Hijacked to Silently Reroute S3 Data Streams
Palo Alto's Unit 42 published research on June 22 showing that an attacker with bucket-deletion permissions in a compromised environment can delete a destination bucket and recreate the same globally unique name in an attacker-owned account, silently rerouting data streams. The recreation happens in the attacker's account, so after the initial deletion the victim sees no further event, and Unit 42 notes the hijack can remain largely undetected.
Demonstrated-vulnerable paths include S3 bucket replication and Amazon Data Firehose on AWS, plus equivalents in GCP and Azure. Unit 42 is explicit that this is research only: no real-world threat actor has been identified using the technique.
Mitigations: least-privilege on DeleteBucket, data-perimeter controls with SCPs and VPC endpoints, alerts on bucket-deletion APIs, and S3 account-regional namespaces, which eliminate the vector.
S3Kinesis
high/Threat Intel/
Targeted Phishing Kit Clones the AWS Console and Walks Victims Through MFA
Datadog Security Labs documented a curated adversary-in-the-middle phishing campaign observed June 16-19: three AWS-impersonating domains, including us-west-login[.]com and loginportal-aws[.]com, served near-identical clones of the AWS console sign-in page, alongside three SendGrid-impersonating domains.
The kit runs a server-driven flow that validates an encrypted per-victim email parameter, captures passwords, then dynamically branches into email, SMS, or authenticator-app MFA challenges. Targeting was tight: fewer than 50 target email addresses, primarily US-based software engineers and engineering leadership, each with an individual phishing link. Datadog notes real-time relay to AWS is likely but was not confirmed in testing.
Hunt ConsoleLogin events in CloudTrail and prefer phishing-resistant MFA (passkeys, hardware keys) for console identities.
IAMCloudTrail
CVEs & Vulnerabilities
1 item
$ cat /var/reports/CVE_REPORT.txt
high/CVE/
CVE-2026-12957 / CVE-2026-12958: Amazon Q Developer Ran Attacker Commands on Repo Open
AWS bulletin 2026-047-AWS covers two trust-boundary flaws in Amazon Q Developer and the Language Servers for AWS.
Per Wiz's June 26 disclosure of CVE-2026-12957, Amazon Q automatically loaded MCP configurations from .amazonq/mcp.json inside a workspace with no prompt, no consent, and no workspace trust check, so simply opening a poisoned repository executed attacker-specified commands. Spawned processes inherited the full user environment, including AWS credentials; Wiz's proof of concept exfiltrated the caller identity. CVE-2026-12958 is a missing symlink-validation issue where a malicious symlink resolves outside the workspace trust boundary.
AWS remediated both in Language Servers for AWS 1.69.0 and the corresponding IDE plugin releases. Auto-update normally handles this; verify your fleet is current.
Affected
Language Servers for AWS < 1.69.0
Amazon Q Developer for VS Code < 2.20
JetBrains < 4.3
Eclipse < 2.7.4
AWS Toolkit with Amazon Q for Visual Studio < 1.94.0.0
EC2 AMI Watermarks Bring Provenance to Golden Images
Amazon EC2 announced AMI Watermarks on June 24: custom identifiers embedded in private AMIs that automatically propagate to copies across Regions and to images derived from running instances, and remain visible when AMIs are shared with other accounts, with metadata including AMI ID, owner ID, Region, and creation timestamps.
Combined with Allowed AMIs and Declarative Policies, launches can be restricted to approved images. Available in all Regions including China and GovCloud (US), at no additional cost.
EC2
medium/Feature Launch/
Lambda MicroVMs: VM-Level Isolation for Untrusted and AI-Generated Code
AWS introduced Lambda MicroVMs on June 22: a Firecracker-based serverless primitive providing VM-level isolation for untrusted or dynamically generated code, including AI-generated code.
MicroVMs offer near-instant launch and resume, state preservation up to 8 hours, and dedicated per-MicroVM HTTPS URLs supporting HTTP/2, gRPC, and WebSockets. Regions at launch: N. Virginia, Ohio, Oregon, Tokyo, and Ireland.
A sanctioned sandbox for agent-generated code removes the temptation to run untrusted code inside shared runtimes.
Lambda
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
Turn on Sign-In network restrictions: it is the cheapest kill switch yet against stolen console credentials, and this week's Datadog phishing research shows exactly why you need it. Then check that every developer's Amazon Q plugin is on Language Servers 1.69.0 or later, because opening a repository should never cost you your AWS credentials.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
