From 'Huh' to Privilege Escalation - Finding AWS Console Vulnerabilities Through Bug Discovery

Learn how a simple debugging exercise evolved into discovering a significant AWS security vulnerability in this 24-minute conference talk from fwd:cloudsec. Follow along as the speaker demonstrates the journey from encountering unexpected behavior in the AWS console to uncovering an API vulnerability related to iam:PassRole permissions. Explore the investigative process using CloudTrail logs and API documentation, while understanding how regular development work can lead to important security findings. Gain insights into security research methodology, debugging techniques, and the overlap between development and security testing. Discover practical takeaways about AWS security requirements, building secure systems, and leveraging AWS features like CloudTrail for both debugging and security research purposes. Perfect for developers, platform engineers, and security professionals interested in real-world AWS security research and vulnerability discovery.