This section is going to focus on a single GuardDuty finding type: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The AWS documentation describes that this finding will be triggered when credentials that were created exclusively for an EC2 instance through an instance launch role are being used from an external IP address (https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_unauthorized.html#unauthorized11). Basically, when an EC2 instance is launched and an IAM instance profile is attached to it, GuardDuty expects the credentials for that role to only ever be used within that single instance, or at least that's what it makes it sound like, but we'll get into that soon. ...
Bypassing EC2 instance credential exfiltration alerts
Get Hands-On AWS Penetration Testing with Kali Linux now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
