Loading story…
AWS guidance highlights Resource Control Policies (RCPs) as organization-level guardrails that constrain resource policies, including access granted to principals outside an AWS Organization. RCPs complement Service Control Policies by applying to external principals, helping prevent attacker-controlled accounts from bypassing internal SCP restrictions. They can enforce data-perimeter standards for cross-account access, IAM role assumption, OIDC federation, and transport security, alongside controls such as VPC Block Public Access and centrally managed root access.
For Amazon S3, AWS supports bucket and access-point policies using s3:TlsVersion and aws:SecureTransport to require stronger encryption in transit, including TLS 1.3 where needed; AWS service API endpoints require TLS 1.2 or later by default. Organizations should use IAM Access Analyzer and access logs to identify dependencies, test RCPs in sandbox accounts, and roll them out progressively because RCPs lack an audit-only mode and can generate generic AccessDenied errors. Legacy TLS clients can be isolated behind CloudFront, while S3 Access Points allow stricter TLS requirements for selected access paths to the same data.
Map this exposure pattern across your cloud, code, and identities.
11 events from the most recent confirmed update back to the earliest known activity.
AWS published a blog post announcing that all AWS service API endpoints would be updated to require at least TLS 1.2.
Amazon S3 introduced the s3:TlsVersion IAM policy condition key, enabling customers to enforce TLS protocol-version requirements for S3 requests.
Amazon S3 launched in 2006 with support for object access over either HTTP or HTTPS.
AWS announced private resource-sharing options across VPC and AWS-account boundaries using AWS PrivateLink, VPC Lattice, Amazon EventBridge, and AWS Step Functions.
AWS announced CloudFront VPC origins, allowing private-subnet EC2 instances, ALBs, and NLBs to be fronted by CloudFront, and announced ALB header modification for changes including HSTS header insertion.
AWS announced an Incident Response service as part of its security-relevant product announcements.
AWS released centrally managed root access for AWS accounts, enabling tightly controlled root-level recovery actions such as correcting a misconfigured S3 bucket policy.
AWS introduced organization-level Declarative Policies for six EC2-related settings, including IMDSv2 enforcement and AMI-use restrictions, along with VPC Block Public Access to prevent unintended public EC2 exposure.
AWS updated its data-perimeter-policy-examples repository with RCP examples, including policies to restrict IAM role assumption to organization identities or approved third parties and constrain trusted OIDC tenants.
AWS released Resource Control Policies (RCPs), organization-level guardrails that constrain resource policies and can restrict public or unauthorized external access to resources such as S3 buckets.
AWS required a minimum of TLS 1.2 for all service API endpoints, including Amazon S3. AWS said S3 bucket and Access Point policies requiring TLS 1.2 were therefore no longer necessary, though policies can still enforce TLS 1.3 or higher.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
7 references tracked. Mallory keeps watching after this page renders.
docs.aws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourcewiz.io
Open sourcewiz.io
Open sourceaws.amazon.com
Open sourceaws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers who obtain AWS programmatic credentials with broad Amazon S3 permissions can overwrite objects using **server-side encryption with customer-provided keys** (`SSE-C`). The attackers control the AES-256 keys, which AWS does not store or recover; consequently, organizations cannot decrypt the replaced objects without the original attacker-held keys. The technique can be paired with a ransom note and a seven-day bucket lifecycle deletion policy, creating both an extortion mechanism and a risk of permanent data loss. Organizations should collect Amazon S3 data events in AWS CloudTrail and alert on successful `PutObject` activity specifying SSE-C/AES256 encryption, especially where the behavior is new for an IAM principal or bucket. Defenses include enabling S3 versioning to preserve recoverable object versions, enforcing least-privilege IAM and restrictive bucket policies, and monitoring changes to lifecycle configurations. S3 default server-side encryption should be configured as appropriate, but it does not eliminate the risk from authorized requests that explicitly supply attacker-controlled SSE-C keys.
Sep 9, 2026
Amazon Web Services (AWS) has been officially designated as a critical third-party provider (CTPP) by the European Supervisory Authorities under the European Union’s Digital Operational Resilience Act (DORA). This designation means AWS will be subject to direct joint oversight by the European Banking Authority, the European Securities and Markets Authority, and the European Insurance and Occupational Pensions Authority, reflecting AWS’s significant role in supporting the operational resilience of the EU financial sector. Financial institutions using AWS must now consider this regulatory oversight as part of their compliance and risk management strategies, leveraging AWS’s security and resilience features while maintaining their own compliance responsibilities. The broader regulatory landscape in 2025 is increasingly interconnected, with DORA, GDPR, and DMARC forming a complex web of compliance obligations for organizations operating in the EU. Businesses must address overlapping requirements for data protection, operational resilience, and email security, especially when using cloud services like AWS. The integration of these frameworks underscores the need for a unified approach to digital accountability, ensuring protection of data, infrastructure, and identity across all digital operations.
Jun 29, 2026
Wiz found that S3-compatible object-storage offerings from Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and DigitalOcean can differ substantially from Amazon S3 in public-bucket behavior, IAM semantics, access-key handling, encryption, logging, and API implementation. The assessment warns that application teams may mistake S3 API compatibility—including Cloudflare R2's S3-compatible interface—for equivalent security guarantees and least-privilege controls. Across the providers reviewed, Wiz identified inconsistent protections against exposed credentials, limited granular key restrictions and data-plane logging in some services, and differences in anonymous bucket and object-listing behavior; DigitalOcean was noted as an exception where public-bucket object listing may be possible. The report also highlighted cross-provider risks from bucket namesquatting and reusable presigned URLs, urging organizations to validate each provider's authorization, public-access, audit, and credential-control behavior rather than relying on AWS S3 assumptions.
Sep 3, 2026