🔶 AWS CloudTrail vulnerability: Undocumented API allows CloudTrail bypass

The Datadog Security Research Team identified a method to bypass CloudTrail logging for specific IAM API requests via undocumented APIs. This technique would allow an adversary to perform reconnaissance activities in the IAM service after gaining a foothold in an AWS account, without leaving any trace of their actions in CloudTrail.

https://securitylabs.datadoghq.com/articles/iamadmin-cloudtrail-bypass

#aws