The nature of the vulnerability
Security researchers have identified a flaw in how some third-party services connect to Amazon Web Services (AWS). Many UK businesses use external software to manage their cloud billing, monitoring, or security. These tools require access to the business's AWS account, usually through a mechanism called a 'cross-account role'.
The vulnerability allows an attacker to breach the third-party provider and then move into the accounts of that provider's customers. This is known as a supply-chain attack. Instead of attacking your business directly, the attacker targets a trusted vendor you already use. If successful, they can steal 'secrets'—digital keys used to access sensitive data or other services.
How the attack works
The research indicates that the problem lies in the way some providers have implemented their integration. Attackers found they could manipulate the provider's internal systems to request access tokens for any customer account linked to that provider.
AWS provides a feature called 'External ID' specifically to prevent this type of cross-account access, but the researchers found that if a provider misconfigures their side of the connection, the External ID can be bypassed. This allows the attacker to act as if they are the legitimate service provider, accessing your data without your knowledge.
Actions for UK businesses
AWS has stated that their core infrastructure remains secure and this is not a breach of AWS itself. The risk lies with the third-party vendors. However, the responsibility for securing the access granted to these vendors falls on the business owner.
You should identify every third-party service that has access to your AWS environment. Review the permissions granted to these services; if a tool only needs to monitor billing, it should not have permission to delete data or create new user accounts.
We recommend contacting your cloud service providers to confirm they have reviewed the Wiz research and updated their integration methods. If a provider cannot confirm their security stance, it may be necessary to revoke their access until they provide a technical update.