Loading story…
AWS has made AWS Management Console Private Access generally available, enabling organizations to route supported console traffic through AWS PrivateLink interface VPC endpoints rather than the public internet. The service supports console authentication, static assets, console-only APIs, and supported AWS service console traffic, allowing administrators in internet-isolated VPCs to access the console through private network paths.
Deployments require VPC endpoints for the AWS Management Console and sign-in services, with a console-static endpoint also required for VPCs without internet connectivity; separate PrivateLink endpoints remain necessary for AWS services accessed through their consoles. Organizations can enforce access boundaries with endpoint policies, sign-in resource control policies, resource-based policies, and service control policies. AWS cautioned that initial IAM Identity Center SSO authentication is not supported through these endpoints and still requires internet access.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
AWS initially launched AWS Management Console Private Access, though console static assets and console-only APIs still required internet connectivity at that time.
AWS made AWS Management Console Private Access generally available in all commercial AWS Regions for a select set of supported service consoles, enabling supported console traffic to use AWS PrivateLink VPC endpoints without public-internet routing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceaws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS guidance highlights **Resource Control Policies (RCPs)** as organization-level guardrails that constrain resource policies, including access granted to principals outside an AWS Organization. RCPs complement Service Control Policies by applying to external principals, helping prevent attacker-controlled accounts from bypassing internal SCP restrictions. They can enforce data-perimeter standards for cross-account access, IAM role assumption, OIDC federation, and transport security, alongside controls such as VPC Block Public Access and centrally managed root access. For Amazon S3, AWS supports bucket and access-point policies using `s3:TlsVersion` and `aws:SecureTransport` to require stronger encryption in transit, including TLS 1.3 where needed; AWS service API endpoints require TLS 1.2 or later by default. Organizations should use IAM Access Analyzer and access logs to identify dependencies, test RCPs in sandbox accounts, and roll them out progressively because RCPs lack an audit-only mode and can generate generic `AccessDenied` errors. Legacy TLS clients can be isolated behind CloudFront, while S3 Access Points allow stricter TLS requirements for selected access paths to the same data.
Sep 3, 2026
Wiz documented **Console Conceal**, a technique in which an attacker with stolen IAM-user credentials and permission to call `AssumeRole` selects an arbitrary role-session name and creates a federated AWS Management Console session. CloudTrail records subsequent console activity under a derived temporary access key rather than the access key issued in the initiating `AssumeRole` event, frustrating direct access-key correlation between the activity and the compromised IAM principal. AWS organizations should require and monitor **SourceIdentity** on role assumptions, as it propagates an administrator-controlled, immutable identity into subsequent CloudTrail events. For historical sessions without SourceIdentity, investigators can correlate suspicious console events to role assumptions using the role name, role-session name, and session-creation timing, while reviewing CloudTrail `userIdentity` fields and tightening IAM permissions that permit role assumption and custom identity-broker console access.
Sep 3, 2026
AWS is rolling out a simplified sign-up experience that lets customers use Google, GitHub, or Apple identities to create a preconfigured project with Free Tier credits and configurable monthly spending limits. The environment is implemented as a restricted three-account AWS Organization sandbox—comprising a user-facing member account plus hidden management and identity accounts—and can pause projects or apply controls that prevent new workload creation after a budget threshold is reached. AWS also automates service permissions through console workflows, coding agents, and IAM Role Manager, reducing the need to create IAM users, trust policies, or service permissions manually. Security researchers found the sandbox is designed for onboarding and cost control rather than a complete security baseline. It does not enable CloudTrail and blocks GuardDuty, Security Hub, Detective, Inspector, Macie, and IAM Access Analyzer; it can also allow IAM access keys, public S3 buckets after protections are disabled, and EC2 instances using IMDSv1. Generated roles remain visible and modifiable, but may receive broad permissions such as `PowerUserAccess` where AWS cannot infer required access, requiring review and least-privilege refinement. Organizations needing centralized governance, multiple Regions, or full security-service coverage must enable advanced features and review inherited automated access rules and restrictive sandbox policies.
Sep 17, 2026