Incident response guide for AWS CloudTrail investigations – Part 2

This article presents a complex multi-stage attack scenario showing how a web application SSRF vulnerability cascades into credential harvesting via IMDSv1 and unauthorized Amazon Bedrock service misuse across multiple AWS regions.

• SSRF vulnerability in web application exploited to harvest temporary credentials from IMDSv1 endpoint
• Threat actor used harvested webdev role credentials to probe IAM permissions, then pivoted to Amazon Bedrock
• Region-hopping from us-east-1 to us-east-2 demonstrates deliberate evasion of region-specific monitoring
• CloudTrail events traced five-stage attack: initial access, credential harvesting, permission testing, service pivoting, and region hopping
• Key forensic indicators include userIdentity fields, ec2RoleDelivery value, readOnly flags, and sessionCredentialFromConsole markers
• Remediation priorities: enforce IMDSv2, apply least-privilege IAM policies, enable Bedrock model invocation logging, maintain consistent cross-region monitoring
• Advanced evasion techniques include role/user name imitation and HIDDEN_DUE_TO_SECURITY_REASONS username spoofing

Implementing IMDSv2, least-privilege IAM, comprehensive CloudTrail analysis, and consistent cross-region security controls are essential to prevent similar attack chains.