AWS Security Digest·Week 29 of 2026·Jul 13-19, 2026·12 items
GuardDuty AI Protection Arrives, and the Bulletins Pile Up
GuardDuty extends threat detection to Bedrock and SageMaker workloads, Security Hub goes multicloud with Azure support and an AI asset inventory, and Cognito removes the last big migration blocker by importing password hashes. Seven AWS bulletins land in four days, including a prompt-and-response leak in AgentCore telemetry.
In this issue4high6medium2info
Highlights
3 items
$ tail -f /var/log/aws-security.log
high/Feature Launch/
GuardDuty AI Protection: Native Threat Detection for Bedrock and SageMaker
Amazon GuardDuty AI Protection, announced July 14, extends threat detection to AWS AI workloads on Amazon Bedrock and Amazon SageMaker.
It analyzes CloudTrail management and data events to detect anomalous model invocations, cost harvesting attacks where adversaries force AI resources to burn GPU time and tokens, and prompt injection attempts via integration with Bedrock Guardrails. It is enabled from the GuardDuty or Security Hub console, centrally manageable through AWS Organizations, with a 30-day free trial.
AI-specific abuse patterns finally get native detection that existing controls were never designed to see.
GuardDutyBedrockSageMaker
high/Feature Launch/
Security Hub Goes Multicloud: Azure Support and an AI Asset Inventory
AWS Security Hub now monitors Microsoft Azure resources, announced July 14: Virtual Machines, container images, Function Apps, and identities, evaluated against the CIS Microsoft Azure Foundations Benchmark, priced the same as equivalent AWS resources with a 30-day free trial.
The same announcement brings Security Hub AI Inventory to general availability, cataloging AI assets across Bedrock, SageMaker, AgentCore, EC2, ECS, and EKS at no additional cost in Essentials. Security Hub Extended now includes 21 partner solutions across nine categories via OCSF.
One pane for multicloud and AI posture means less tool sprawl for hybrid estates.
Security Hub
medium/Feature Launch/
Cognito Now Imports Password Hashes: Migrations Without the Reset Email
Amazon Cognito CSV user imports can now include password hashes, announced July 15, in bcrypt, scrypt, Argon2id, or PBKDF2 with SHA-256.
Migrated users sign in immediately instead of being forced through a password reset, and imported hashes receive an additional layer of cryptographic protection at rest. Available in all Cognito Regions.
This removes the main friction, and the risky reset-everyone flow, from migrating identity providers into Cognito.
Cognito
CVEs & Vulnerabilities
7 items
$ cat /var/reports/CVE_REPORT.txt
high/CVE/
CVE-2026-15737: AgentCore SDK Telemetry Wrote Full Prompts and Responses to CloudWatch
AWS bulletin 2026-058-AWS covers a data-exposure flaw in the Bedrock AgentCore Python SDK's OpenTelemetry instrumentation.
Versions 1.4.8 and 1.5.0 wrote raw user prompts and complete agent responses into span attributes on every invocation, without filtering or masking. Those spans land in the customer's aws/spans CloudWatch log group, so a local authenticated user with CloudWatch Logs read access could retrieve the unfiltered conversations.
Upgrade to 1.5.1; there is no workaround. Then review who holds CloudWatch Logs read access, and assume prompts from the affected window are in your logs.
Affected
bedrock-agentcore 1.4.8
bedrock-agentcore 1.5.0
Fixed In
bedrock-agentcore 1.5.1
BedrockCloudWatch
high/CVE/
CVE-2026-15643: SSRF in the HealthLake MCP Server Could Leak AWS Credentials
AWS bulletin 2026-054-AWS covers an SSRF flaw in awslabs.healthlake-mcp-server.
The server did not validate that pagination URLs point back to the intended HealthLake endpoint, so a remote authenticated user could use a crafted next_token parameter to send AWS temporary security credentials to an arbitrary endpoint.
Update to 0.0.14.
Affected
awslabs.healthlake-mcp-server < 0.0.14
Fixed In
awslabs.healthlake-mcp-server 0.0.14
IAM
medium/CVE/
CVE-2026-15738: Route Precedence Flaw in the AWS Load Balancer Controller
AWS bulletin 2026-055-AWS covers a rule precedence ordering flaw in the AWS Load Balancer Controller's Gateway API support.
When an HTTPRoute and a GRPCRoute share the same ALB HTTPS listener and hostname, rules were prioritized by route type rather than specificity. A namespace-scoped user could create a catch-all HTTPRoute that intercepts traffic intended for a more specific GRPCRoute in another namespace.
Upgrade to v3.4.2. Until then, restrict Gateway listener namespaces to Same or use selective namespace selectors.
Affected
AWS Load Balancer Controller <= v3.4.1 (HTTPRoute + GRPCRoute on a shared listener)
Fixed In
AWS Load Balancer Controller v3.4.2
EKSELB
medium/CVE/
CVE-2026-15746: Strands Agents Tool Could Leak Elasticsearch API Keys
AWS bulletin 2026-056-AWS covers the elasticsearch_memory tool in strands-agents-tools.
Connection parameters (es_url, cloud_id, api_key) were controllable through the LLM tool schema, and when the API key argument was omitted, the tool fell back to the ELASTICSEARCH_API_KEY environment variable. A crafted prompt could direct the tool to connect to an adversary-controlled server, disclosing the operator's API key in the Authorization header.
AWS bulletin 2026-057-AWS covers an OS command injection in the jsii-diff utility from the AWS jsii toolchain.
Specially formatted command-line arguments can execute shell commands, so anyone who controls jsii-diff arguments can run arbitrary commands on the host.
Upgrade to 1.131.0. If you cannot, make sure only trusted actors control its arguments, especially in CI.
Affected
jsii-diff < 1.131.0
Fixed In
jsii-diff 1.131.0
medium/CVE/
CVE-2026-12283: SQL Injection via Table Names in Athena's Synapse Connector
AWS bulletin 2026-059-AWS covers a SQL injection in the Azure Synapse connector of Athena Query Federation.
A user with access to the connected Synapse instance could create tables with specially crafted names so that queries made through the Athena connector retrieve unintended data. The affected range spans v2022.20.1 through v2026.19.1.
Upgrade to v2026.21.1, audit Synapse databases for malicious table names, and sanitize programmatic table creation.
AWS bulletin 2026-060-AWS covers a path traversal and arbitrary file write flaw in the linting tools of aws-healthomics-mcp-server.
An attacker who can control the MCP agent could use directory traversal sequences in workflow file inputs to write content outside the intended workflow bundle directory.
AWS IAM Identity Center is now in scope for FedRAMP Class C, announced July 14, in US East (Ohio), US East (N. Virginia), US West (N. California), and US West (Oregon).
Organizations aligned to that compliance level can standardize workforce access management on Identity Center instead of maintaining separate identity tooling.
Identity Center
info/Compliance/
New Compliance Guidance: HITRUST i1 on AWS
AWS published new compliance guidance for achieving HITRUST i1 certification on AWS, announced July 13.
Healthcare-adjacent teams pursuing i1 get an AWS-specific mapping to work from.
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
If you run agentic AI on AWS, this was your patch week: the AgentCore SDK telemetry leak (CVE-2026-15737) means full prompts and responses may already sit in your CloudWatch logs, so upgrade to 1.5.1 and audit log access now. Then turn on GuardDuty AI Protection and let Security Hub's AI Inventory tell you what AI assets you actually have.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
