How to Prevent Cross-Service Confused Deputy Attacks | Qualys
Summary: A Qualys blog post describes the Cross-Service Confused Deputy Attack, in which a trusted AWS service such as ELB or CloudTrail is tricked into writing into a victim's S3 bucket because the bucket policy lacks account-specific condition keys. The post walks through a four-step ELB example: the victim attaches a generic policy allowing logdelivery.elasticloadbalancing.amazonaws.com, an attacker in another AWS account points their ELB at the victim's bucket, and AWS writes logs under AWSLogs/<attacker-account-id>/ into it.
Key Takeaway: Any AWS account that knows your bucket name and path structure can write into it through a service AWS already trusts, and the post notes this can pollute logs, hide attacker activity, mislead forensic investigations, and hinder compliance. The fix it names is narrow: an aws:SourceAccount condition key and a precise ARN path in the bucket policy.
Read the original at Qualys Blog ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026