Bypassing EC2 instance credential exfiltration alerts

This section is going to focus on a single GuardDuty finding type: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The AWS documentation describes that this finding will be triggered when credentials that were created exclusively for an EC2 instance through an instance launch role are being used from an external IP address (https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_unauthorized.html#unauthorized11). Basically, when an EC2 instance is launched and an IAM instance profile is attached to it, GuardDuty expects the credentials for that role to only ever be used within that single instance, or at least that's what it makes it sound like, but we'll get into that soon. ...

Get Hands-On AWS Penetration Testing with Kali Linux now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.