Internet Scale Analysis of AWS Cognito Security

This talk analyzes insecure AWS Cognito identity-pool configurations through account-specific demonstrations and automated internet-scale research. It examines IAM permissions, least privilege, exposed access to S3, DynamoDB, and Lambda resources, and recommendations for secure configuration.

Syllabus

Intro
Full AWS account compromise
Privilege escalation
What Is Amazon Cognito?
Amazon Cognito use case
Create new identity pool
Assign IAM roles to identities
IAM policy example
Internet Scale analysis
Challenge #1: Identity Pool UUID4
Google only indexes text
Other (boring) sources
Challenge #2: Enumerate permissions
Enumerate permissions and avoid jail time
Enumerate permissions / Performance
Privileges and roles
Identity pool sources
Usable identity pools
Insecure configurations
Lambda function environment variables
Insecure by default documentation
Restrictions on Unauthenticated Cognito roles
Developer can shoot himself in the foot
Least privilege principle and more...
Hard-coded credentials
Key takeaways