Aqua Security’s Nautilus team disclosed six AWS service vulnerabilities at Black Hat USA 2024 that abused predictable, automatically created S3 bucket names. The technique—called Bucket Monopoly—could let an attacker pre-claim a bucket that an AWS workflow later expected to use. Depending on the service, data flows, and IAM permissions, the scenarios could enable data exposure, workload manipulation, denial of service, remote code execution, service takeover, or escalation toward account compromise.
AWS said the reported service issues were fixed by June 26, 2024, and that customers did not need to take action. That does not eliminate the value of checking historical activity, stale resources, IAM permissions, or similar risks in third-party and infrastructure-as-code tooling.
As an Amazon Associate I earn from qualifying purchases.
What the “bucket trap” actually was
The Black Hat presentation, “Breaching AWS Accounts Through Shadow Resources,” described a class of design problems rather than an ordinary public-bucket mistake. AWS services could create or expect supporting resources that customers did not realize existed. In the reported cases, those resources included S3 buckets with names derived from service information, an account-related identifier, and an AWS Region. The exact naming logic differed by service and should be treated as historical.
Recommended Free Tools
Aqua used Shadow Resources for the broader problem: provider-managed resources that are hidden from normal customer workflows but trusted by a service. Bucket Monopoly was the specific tactic of registering likely bucket names in advance and holding them until a target activated a susceptible workflow. See Aqua’s technical account at Aqua Security and conference coverage from Duo Decipher.
#1 Best Overall
- A customer starts using an affected AWS service in a Region.
- The service creates or expects a supporting S3 bucket.
- An attacker has already claimed the predictable name in that Region.
- The customer’s service interacts with the attacker-controlled bucket as if it were the intended resource.
- What happens next depends on whether the workflow reads attacker-controlled objects, writes sensitive data, executes artifacts, or uses an overpowered service role.
This was not necessarily an attacker breaking into an existing customer-owned bucket, and a claimed name did not automatically equal administrative control of an account. The bucket supplied a resource the workflow trusted; permissions and workflow design determined the blast radius.
Which six AWS services were affected?
| Service | Why the resource mattered | Potential consequence reported | Qualification |
|---|---|---|---|
| AWS CloudFormation | Templates, packages, and deployment operations | Artifact or template manipulation, code execution, infrastructure changes, and possible escalation | Dependent on stack behavior, roles, and IAM permissions |
| AWS Glue | Serverless data-integration and ETL workflows | Data interception, alteration, or exposure | Not every Glue job had the same data path |
| Amazon EMR | Big-data jobs, scripts, and data artifacts | Job or data manipulation and possible code execution | Required relevant bucket interaction and permissions |
| Amazon SageMaker | Machine-learning assets and workflows | Manipulation of AI/ML workloads or exposure of related data | Does not mean every model or endpoint was compromised |
| AWS Service Catalog | Approved products and governed provisioning | Interference with provisioning or service workflows | AWS confirmed a fix on June 26, 2024 |
| AWS CodeStar | Development-project and artifact resources | Project or artifact compromise in applicable workflows | Addressed as AWS restricted new projects and moved toward deprecation |
AWS’s summary is available through the AWS Builder Center. Aqua did not describe one identical exploit or impact for all six services.
What an attacker could achieve
Reported outcomes ranged from confidentiality and integrity loss to service-level compromise:
- Reading or exfiltrating sensitive objects.
- Supplying or altering scripts, templates, notebooks, or other artifacts.
- Remote code execution when a workflow executed attacker-controlled content.
- Manipulating machine-learning processing.
- Denial of service.
- Taking over a particular service workflow.
- Potential escalation toward AWS account takeover in scenarios with permissive roles or unsafe trust relationships.
“Account takeover” was a possible chain, not the automatic result of registering a bucket. Broad S3 permissions, roles able to create IAM or compute resources, cross-account trust, and automation that executes downloaded artifacts all increased the potential impact. In practical terms, the predictable bucket supplied the attacker-controlled resource; excessive permissions and unsafe assumptions determined how far the compromise could travel. Related reporting appears in TechTarget and SC Media.
Rank #3
Disclosure and remediation timeline
| Date | Event |
|---|---|
| February 2024 | Aqua discovered and reported the vulnerabilities to AWS. |
| March 16, 2024 | AWS confirmed fixes for CloudFormation and EMR. |
| March 25, 2024 | AWS confirmed fixes for Glue and SageMaker. |
| April 30, 2024 | Aqua reported that an initial CloudFormation fix still left a denial-of-service issue. |
| May 7, 2024 | AWS said it was working on the CloudFormation issue. |
| June 26, 2024 | AWS confirmed fixes for Service Catalog and CloudFormation. |
| August 7–9, 2024 | The research was publicly reported and presented at Black Hat USA and DEF CON 32. |
The disclosure therefore followed remediation work; it was not an announcement of a currently unpatched AWS flaw. The Register’s conference report is at The Register.
Does an AWS customer need to patch anything?
AWS told SecurityWeek and SC Media that the issues had been fixed, services were operating as expected, and no customer action was required. That statement applies to the disclosed AWS service behavior, not to every historical event, manually managed resource, or unrelated tool. Sources: SecurityWeek and SC Media.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What cloud teams should check now
Inventory services, accounts, and Regions
- List CloudFormation, Glue, EMR, SageMaker, Service Catalog, and CodeStar usage across every account.
- Include inactive Regions, legacy accounts, and old deployment environments.
- Identify service-created buckets and deployment-artifact buckets that are still referenced.
Investigate S3 and CloudTrail activity
Where logging is enabled, review unexpected CreateBucket, PutObject, GetObject, ListBucket, and DeleteObject events. Look for access from unfamiliar accounts, objects written immediately before a job or deployment consumed them, repeated bucket-resolution errors, and activity around first use of a service. AWS documents S3 data-event logging at CloudTrail data events.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallReview service roles and trust policies
- Replace unnecessary
s3:*permissions with specific actions and bucket ARNs. - Remove wildcard bucket resources where a named resource is possible.
- Audit roles that can read and execute S3-hosted artifacts.
- Check cross-account trust and permissions to create IAM roles, policies, Lambda functions, or other privileged resources.
- Use explicit denies and least privilege where they will not break legitimate pipelines.
Use the recommendations in AWS IAM best practices.
Check deployment and infrastructure-as-code paths
- Ensure templates, packages, notebooks, and scripts come from controlled repositories or buckets.
- Prefer explicit resource references where supported, while accounting for reduced portability across accounts and Regions.
- Review stack events and CloudTrail for unexpected role creation, policy changes, or artifact substitutions.
- Follow AWS guidance in CloudFormation security best practices.
Find deleted resources with live references
Search repositories, CI/CD configuration, CDK bootstrap settings, and historical deployment records for buckets that were manually deleted while references remained. In a separate October 2024 disclosure, Aqua described a related AWS CDK risk involving missing deployment-artifact buckets; it was not one of the six vulnerabilities discussed at Black Hat. Read the separate report at Aqua’s CDK analysis.
Best Value
Preserve evidence if you find suspicious activity
- Preserve CloudTrail, S3 access, CloudWatch, and deployment records.
- Do not delete suspicious buckets or objects before collecting evidence.
- Rotate credentials for plausibly affected roles.
- Review IAM, Lambda, CloudFormation, and organization-level changes.
- Contact AWS Support or an AWS incident-response channel.
- Determine whether data was read, modified, or exfiltrated.
What this incident teaches about cloud security
- Provider-managed “hidden” resources must be discoverable and auditable.
- Predictable names in a shared or global namespace deserve ownership checks.
- Least privilege limits the consequences when a workflow consumes an unexpected resource.
- Infrastructure-as-code and third-party frameworks can recreate trust assumptions even after a provider fix.
- Logging is essential for historical investigation, but it does not itself prevent a compromised workflow.
Public reporting documents discovery, demonstration, disclosure, and remediation; it does not establish widespread exploitation of these specific flaws against customers. The appropriate current posture is historical-risk review and broader resource-trust hygiene, not treating the six services as an active unpatched vulnerability.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
