Api Security | Techlist.io

gitlabAug 12, 20263 min readCurated summary

GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6 | GitLab Docs

GitLab released patch versions 19.2.2, 19.1.4, and 19.0.6 on August 12, 2026, addressing multiple security and bug issues in CE and EE. The release fixes vulnerabilities involving cross-site scripting, authorization bypasses, privilege escalation, data exposure, and denial of service. Self-managed installations should upgrade immediately; GitLab.com is already patched, and GitLab Dedicated customers need no action. ## Release Scope and Upgrade Guidance - The patches apply to GitLab Community Edition and Enterprise Edition. - GitLab recommends upgrading all affected self-managed installations to the latest patch for their supported release line. - Patch releases may be scheduled or issued ad hoc for critical vulnerabilities. - Security issues are generally disclosed publicly 90 days after the release containing their fixes. - Unless a deployment type is explicitly excluded, omnibus, source, Helm chart, and other installation types are affected. ## Cross-Site Scripting Vulnerabilities - **CVE-2026-15217** affects Analytics Dashboards table field configuration. - Improper neutralization of user-controlled values could allow XSS in table cell content. - CVSS: **8.7**. - **CVE-2026-15216** affects Analytics Dashboards pagination controls. - User-controlled data could be rendered unsafely and enable XSS. - CVSS: **8.7**. - **CVE-2026-16627** affects the CI manual job confirmation modal. - Authenticated developers could potentially escalate privileges through unsanitized HTML. - CVSS: **7.7**. ## Authorization and Privilege Issues - **CVE-2026-15423** affects the CI/CD pipeline API. - Developer-role users could run pipelines on protected branches without the required push permissions. - CVSS: **8.5**. - **CVE-2026-19228** affects the Duo Workflow Service in GitLab EE. - An authenticated user could attribute AI usage to another namespace. - CVSS: **8.5**. - **CVE-2026-16494** affects the EE ProjectsController. - Missing checks could let authenticated users modify project settings reserved for higher-privileged roles. - CVSS: **7.1**. - **CVE-2026-8667** affects the npm distribution-tags endpoint. - Developers could modify certain package registry metadata without maintainer permissions. - CVSS: **4.3**. ## Information Disclosure and API Access - **CVE-2026-6821** affects the EE merge requests API. - Authenticated users could bypass IP-based restrictions and read limited merge request information from private projects. - CVSS: **4.3**. - **CVE-2026-4879** affects the external status check API. - Developers could view status check configuration restricted to higher-privileged roles. - CVSS: **4.3**. ## Denial of Service - **CVE-2026-7427** affects the GraphQL API JSON parser. - Improper input validation could allow unauthenticated attackers to cause a denial of service. - CVSS: **5.3**. Self-managed GitLab administrators should apply 19.2.2, 19.1.4, or 19.0.6 immediately, depending on their release branch, to receive these security fixes.

Read original

Api Security CI/CD Gitlab GraphQL+3

gitlabJul 29, 20263 min readCurated summary

GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5 | GitLab Docs

GitLab released patch versions 19.2.1, 19.1.3, and 19.0.5 on July 29, 2026, addressing important security and bug fixes in CE and EE. Self-managed installations should upgrade immediately; GitLab.com is already patched, and GitLab Dedicated customers need no action. The release fixes vulnerabilities ranging from unauthorized data access and configuration changes to denial of service and AI-related security issues. ## Release Scope and Upgrade Guidance - Applies to GitLab Community Edition and Enterprise Edition. - Affected self-managed installations should upgrade to: - 19.2.1 - 19.1.3 - 19.0.5 - GitLab issues security patches through scheduled releases twice monthly or through urgent ad-hoc releases. - Vulnerability details are generally made public 90 days after the release containing the fix. ## High-Severity Access and Configuration Vulnerabilities - **CVE-2026-6267 — Workhorse information exposure (CVSS 8.5)** - An authenticated Developer could access unauthorized information because of insufficient access controls in internal request handling. - Affected CE/EE versions extend back to 10.1.0. - **CVE-2026-12436 — Pipeline Schedule API mass assignment (CVSS 8.4)** - An authenticated user could modify another user’s CI/CD configuration through improperly validated pipeline schedule attributes. - Affects versions beginning with GitLab 18.0. - **CVE-2026-13113 — Merge request approval race condition (CVSS 6.5)** - In GitLab EE, an authenticated user could merge code into a protected branch without the required approvals. - The issue resulted from a race condition in approval rule processing. - **CVE-2026-14341 — Project import authorization flaw (CVSS 4.9)** - A Maintainer could modify protected branch configuration through a projects API endpoint. - The vulnerability affected CE and EE. ## Availability, Import, and Credential Protection Fixes - **CVE-2026-15975 — Merge request discussion denial of service (CVSS 7.5)** - An unauthenticated attacker could exhaust resources and cause a denial of service. - The issue involved insufficient throttling when processing discussions. - **CVE-2026-6336 — Project import status access control (CVSS 5.3)** - An unauthorized user could view project import source information because of a missing authorization check. - **CVE-2026-16553 — Virtual Registry credential exposure (CVSS 5.4)** - Improper upstream request handling could disclose sensitive information to an unintended host. - This issue affects GitLab EE virtual registries. ## Web and AI-Assisted Feature Fixes - **CVE-2026-3093 — Cross-site scripting in paginated views (CVSS 4.7)** - A crafted URL could execute attacker-controlled JavaScript in another user’s browser. - The root cause was inadequate sanitization of user-controlled input. - **CVE-2026-15077 — Prompt injection in Duo Code Review (CVSS 4.3)** - Untrusted content processed by AI-assisted code review could allow access to information from unauthorized projects. - This affects GitLab EE versions 19.1 and 19.2 before the patched releases. - **CVE-2026-15831 — Duo Workflows token generation flaw (CVSS 4.3)** - An authenticated user could bypass administrator-configured tool governance policies through improper authorization during token generation. - The issue affects GitLab EE. ## Recommended Action Administrators should upgrade affected self-managed GitLab installations to the latest supported patch release immediately, regardless of deployment method, including Omnibus, source installations, and Helm charts. Regularly applying the newest patch release is GitLab’s recommended security practice.

Read original

Api Security CI/CD Gitlab Prompt Injection+3

gitlabJun 24, 20263 min readCurated summary

GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6 | GitLab Docs

GitLab released patch versions **19.1.1, 19.0.3, and 18.11.6** on June 24, 2026, addressing important bugs and security vulnerabilities in CE and EE. Self-managed installations should upgrade immediately; GitLab.com is already patched, and GitLab Dedicated customers need no action. The release fixes issues ranging from cross-site scripting and information disclosure to authorization bypasses and improper access controls. ## Release Guidance - The patches apply to GitLab Community Edition and Enterprise Edition. - GitLab recommends upgrading all affected self-managed installations to the latest supported patch release. - GitLab publishes scheduled patch releases twice monthly, with additional critical releases when necessary. - Vulnerability details are generally made public 30 days after the fixing release. - Unless otherwise specified, all deployment types—including Omnibus, source installations, and Helm charts—are affected. ## High-Severity Cross-Site Scripting Vulnerabilities - **CVE-2026-10086 — Analytics Dashboard** - A developer-level authenticated user could execute arbitrary client-side code in another user’s session through insufficient input sanitization. - Affects GitLab EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 8.7** - **CVE-2026-10712 — Web IDE Workbench Asset Handler** - Improper path validation could allow an unauthenticated attacker to execute JavaScript in a victim’s browser session. - Affects CE and EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 8.0** ## Information Disclosure and Authorization Issues - **CVE-2026-12053 — Duo Workflows** - Insufficient output filtering could expose sensitive information previously committed to a project. - Affects GitLab EE 19.1 versions before 19.1.1. - **CVSS: 7.7** - **CVE-2026-5309 — Virtual Registry Cleanup Policy API** - Authenticated users could read or modify another group’s cleanup policy settings. - Affects EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 5.4** - **CVE-2026-2238 — Rapid Diffs** - Unauthenticated users could view confidential issue references on public projects. - Affects CE and EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 5.3** - **CVE-2026-11379 — DAST Site Profile Management** - Developer-level users could potentially extract DAST site profile secrets due to incorrect authorization. - Affects EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 5.3** ## Additional Security Fixes - **CVE-2026-8330 — CI/CD API** - Sensitive data could be written to application logs because of insufficient filtering. - **CVSS: 4.4** - **CVE-2026-1606 — Snippets** - Authenticated users could conceal content within snippets through improper input validation. - **CVSS: 4.3** - **CVE-2026-5952 — Maven Package Registry** - Developers could bypass package protection rules and overwrite protected Maven package metadata. - **CVSS: 4.3** - **CVE-2026-5796 — Group Packages API** - Reporters could view package metadata from projects where the Package Registry was disabled. - **CVSS: 4.3** ## Recommended Action Administrators of affected self-managed GitLab instances should upgrade to **18.11.6, 19.0.3, or 19.1.1**, depending on their supported release branch, as soon as possible. Updating promptly is particularly important because several vulnerabilities permit code execution, sensitive-data exposure, or unauthorized access.

Read original

Api Security CI/CD Gitlab Cross Site Scripting+4

gitlabJun 11, 20263 min readCurated summary

GitLab Patch Release: 19.0.2, 18.11.5, 18.10.8 | GitLab Docs

GitLab released patch versions 19.0.2, 18.11.5, and 18.10.8 on June 10, 2026, addressing important security and bug fixes. Self-managed installations should upgrade immediately; GitLab.com is already patched, while GitLab Dedicated customers need no action. The fixes affect both CE and EE and cover account takeover, cross-site scripting, denial of service, authorization bypasses, and server-side request forgery. ## Release Scope and Upgrade Guidance - Affected self-managed installations should upgrade to the latest patch release for their supported GitLab version. - The releases apply to GitLab Community Edition and Enterprise Edition. - GitLab publishes: - Scheduled patch releases twice monthly, on the second and fourth Wednesdays. - Ad-hoc critical patches for high-severity vulnerabilities. - Security issues are generally made public on GitLab’s issue tracker 30 days after the release containing their fix. - GitLab.com has already deployed the patches, and GitLab Dedicated customers do not need to take action. ## High-Severity Enterprise Edition Vulnerabilities - **CVE-2026-6552 — Group SAML Identity API** - CVSS 8.7. - An authenticated group Owner could potentially take over another member’s GitLab account through improper authorization. - Affects GitLab EE versions before 18.10.8, 18.11.5, and 19.0.2. - **CVE-2026-10087 — Analytics Dashboard XSS** - CVSS 8.7. - An authenticated developer could execute arbitrary client-side code on behalf of another user due to inadequate input sanitization. - Affects EE versions before the patched releases. - **CVE-2026-8589 — HTML Injection in Group Settings** - CVSS 7.3. - Improper sanitization could allow unauthorized email addresses to be added to a targeted user’s account. - Requires significant privileges and user interaction. ## Denial-of-Service Vulnerabilities - **CVE-2026-7250 — Grape API JSON Parsing** - CVSS 7.5. - An unauthenticated attacker could cause denial of service through malformed API request input. - Affects CE and EE versions dating back to 12.10. - **CVE-2026-1500 — Group Placeholder Reassignments API** - CVSS 6.5. - An authenticated user could trigger uncontrolled resource consumption with a specially crafted file upload. - Affects CE and EE versions beginning with 17.10. - **CVE-2026-10733 — CI/CD Catalog HTML Injection** - CVSS 4.3. - Improper sanitization could allow an authenticated user to disrupt the CI/CD Catalog page. ## Authorization and Data-Access Issues - **CVE-2026-6269 — Merge Requests API** - CVSS 5.4. - Developers could modify hidden merge requests because of incorrect authorization enforcement. - **CVE-2026-6277 — Security Inventory** - CVSS 4.3. - Security Managers could modify project security configuration even when the related feature was disabled. - **CVE-2026-6976 — Merge Request Diff** - CVSS 3.7. - Developers could hide changes from merge request diffs through improperly handled file names. ## Server-Side Request Forgery - **CVE-2026-9204 — Gitaly Repository Import** - CVSS 5.3. - An authenticated user could potentially read arbitrary files from the Gitaly server or access internal network resources during repository import. - The issue resulted from insufficient validation of secondary URLs. ## Recommendation Administrators of self-managed GitLab instances should upgrade to 19.0.2, 18.11.5, or 18.10.8 as soon as possible, regardless of whether they use Omnibus, source installations, or Helm charts.

Read original

Api Security CI/CD Gitlab Access Control+3

gitlabMay 13, 20262 min readCurated summary

GitLab Patch Release: 18.11.3, 18.10.6, 18.9.7 | GitLab Docs

On May 13, 2026, GitLab released patch versions 18.11.3, 18.10.6, and 18.9.7 for CE and EE. The releases address multiple high-severity security vulnerabilities, including cross-site scripting, denial of service, authorization, and access-control issues. GitLab strongly recommends that all affected self-managed installations upgrade immediately. ## Release Scope and Upgrade Guidance - Applies to GitLab Community Edition and Enterprise Edition. - GitLab.com is already patched; GitLab Dedicated customers do not need to act. - Patch releases may be scheduled or issued urgently for critical vulnerabilities. - Security vulnerability details are published publicly 30 days after the fixing release. - Unless otherwise specified, all deployment types—including Omnibus, source installations, and Helm charts—are affected. ## Cross-Site Scripting Vulnerabilities Several authenticated-user XSS vulnerabilities could allow arbitrary JavaScript to execute in other users’ browsers: - **CVE-2026-7481**: Affects EE Analytics dashboard chart rendering; exploitable by users with Developer permissions. - **CVE-2026-5297**: Affects global search in CE and EE. - **CVE-2026-6073**: Affects EE Duo Agent output rendering. - **CVE-2026-7377**: Affects customizable EE Analytics dashboards. - Each issue received a **CVSS score of 8.7** and resulted from improper input sanitization. ## Denial-of-Service Vulnerabilities The release fixes multiple unauthenticated denial-of-service issues involving malformed requests or files: - **CVE-2026-1659**: Specially crafted requests to the CI/CD job update API could disrupt service. - **CVE-2025-14870**: Malformed JSON payloads targeting the Duo Workflows API could cause a denial of service. - **CVE-2025-14869**: Certain internal API endpoints were vulnerable to specially crafted payloads. - **CVE-2026-1184**: A specially crafted file uploaded through Insights Configuration could cause service disruption. - The API-related issues were rated **CVSS 7.5**; the Insights issue was rated **6.5**. ## Authorization and Access-Control Issues - **CVE-2026-1322**: An authenticated user with a `read_api`-scoped OAuth application could create issues and comment on private projects through GraphQL, due to improper token-scope enforcement. It received a **CVSS score of 6.8**. - **CVE-2026-4524**: Authenticated users could access confidential issue content in public projects through the Issues API without proper authorization checks. It received a **CVSS score of 6.5**. ## Recommended Action Self-managed GitLab administrators should upgrade to the latest supported patch release—18.11.3, 18.10.6, or 18.9.7—as soon as possible, particularly because several vulnerabilities are remotely exploitable and require little or no authentication.

Read original

Api Security Gitlab JavaScript GraphQL+3

gitlabMay 7, 20262 min readCurated summary

A leaked personal access token shouldn't expose every project its owner can reach. Fine-grained PATs scope each token’s permissions to the job.

Fine-grained personal access tokens (PATs) reduce credential exposure by limiting each token to only the projects, groups, resources, and actions required for a specific task. GitLab’s beta lets users replace broad `api` or `read_api` tokens with narrowly scoped permissions, reducing the impact of leaks. The feature is not yet recommended for production because coverage is still incomplete. ## Why Narrow PAT Privileges - Broad, user-scoped tokens can access every project the user can reach. - A leaked token might expose source code, pipelines, container images, or CI/CD variables across many projects. - Fine-grained tokens limit both access and potential remediation to the affected project or resource. - They complement lifetime limits and automatic revocation. ## How Fine-Grained Tokens Work - Scope access by location: - Personal projects - All projects and groups where the user is a member - Specifically selected projects and groups - Assign independent Create, Read, Update, and Delete permissions. - Supported resources include Issues, Merge Requests, Pipelines, Repositories, and Container Registry. - Example: a container-publishing pipeline can receive Create and Read access only to one project’s registry. ## Auditing and Beta Coverage - The token management table displays scopes and per-resource permissions for all tokens. - This makes over-privileged credentials easier to identify during reviews. - Fine-grained PATs currently support about 75% of REST API endpoints. - GitLab plans to add remaining REST endpoints and expand GraphQL support. - Existing traditional PATs continue working alongside fine-grained tokens during the beta. ## Getting Started - Go to **User Settings → Personal Access Tokens**. - Select **Fine-grained token** when generating a token. - Choose the permitted projects or groups and assign resource permissions. - GitLab recommends avoiding fine-grained PATs in production until general availability. Teams should begin evaluating fine-grained tokens for automation and adopt one token per job, with the smallest practical scope. Feedback during the beta will help shape broader endpoint coverage and future improvements.

Read original

Api Security Gitlab GraphQL Rest Api+3

cloudflareApr 14, 20263 min readCurated summary

Securing non-human identities: automated revocation, OAuth, and scoped permissions

Cloudflare argues that securing modern infrastructure requires managing non-human identities—agents, scripts, and third-party applications—as carefully as human users. The core model combines principals, credentials, and policies, with protections covering token leakage, OAuth access visibility, and narrowly scoped permissions. The post focuses especially on automated token detection and revocation, designed to limit damage when credentials are exposed. ## Identity as Three Connected Components - **Principal:** The identity acting on a system’s behalf, such as a developer, AI agent, background service, or OAuth application. - **Credential:** The proof of identity, typically an API token. Anyone who obtains it may impersonate the principal. - **Policy:** The permissions assigned to the identity, determining which resources and actions it can access. - Security failures occur when these elements are managed separately—for example, when a valid identity uses a stolen token or has unnecessarily broad permissions. ## Automated Detection and Revocation of Leaked Tokens - API tokens are commonly exposed by accidentally committing them to public repositories. - Cloudflare cites GitGuardian’s estimate that more than 28 million secrets were published to public GitHub repositories in the previous year, with AI-driven development increasing leak rates. - Cloudflare is partnering with credential-scanning providers to detect leaked tokens and revoke them before attackers can exploit them. - New Cloudflare token formats use a recognizable `cf` prefix and a checksum, allowing scanners to identify tokens confidently and verify whether they are authentic. - Existing tokens remain valid, but newly generated tokens use the scannable format. ## GitHub Secret Scanning Integration - GitHub scans public and private repositories for the new Cloudflare token formats on every commit. - For public repository leaks: - GitHub validates the token using its checksum. - GitHub sends Cloudflare a webhook. - Cloudflare automatically revokes the token. - The user receives an email prompting them to create a replacement. - For private repositories, GitHub notifies the customer so the leaked credential can be removed and replaced. ## Protection Through Cloudflare One Cloudflare One customers can use the Credentials and Secrets DLP profile to detect and block Cloudflare tokens across multiple data paths: - **Network traffic:** Cloudflare Gateway can block tokens in uploads, downloads, and outbound requests. - **Email:** Cloudflare Email Security and the DLP Assist add-in can scan Microsoft 365 messages before external delivery. - **Stored data:** Cloudflare CASB scans connected services such as Google Drive, OneDrive, and Dropbox. - **AI traffic:** Cloudflare AI Gateway can inspect prompts and model responses in real time, addressing credential exposure through AI systems. ## Broader Scanner Ecosystem - Cloudflare is working with open-source and commercial credential-scanning tools. - The goal is to protect customers regardless of which repository or secret-scanning products they use. - Automatic revocation is presented as a critical safeguard because credential exposure is treated as inevitable rather than exceptional. Organizations should use recognizable, verifiable tokens, enable repository and DLP scanning, and ensure leaked credentials are revoked automatically. These controls reduce the window in which an exposed token can be used and should be combined with narrowly scoped permissions for agents and applications.

Read original

Api Security Cloudflare Oauth Data Loss Prevention+4

cloudflareMar 9, 20263 min readCurated summary

Active defense: introducing a stateful vulnerability scanner for APIs

Cloudflare is launching a beta Web and API Vulnerability Scanner to actively detect API logic flaws that defensive tools often miss. Its first target is Broken Object Level Authorization (BOLA), where authenticated users can access or modify another user’s resources through valid requests. The scanner combines Cloudflare’s existing API visibility with stateful DAST to test authorization across sequences of API calls. ## Why Defensive Security Misses API Logic Flaws - Traditional WAFs are effective against recognizable attacks such as SQL injection, XSS, malformed requests, and suspicious payloads. - API vulnerabilities often involve valid requests that violate business rules rather than protocol or schema requirements. - In the food delivery example: - User A sends a valid `PATCH` request for User B’s order. - User A’s token, headers, and request schema are all legitimate. - The vulnerability exists because the API fails to verify that User A owns the order. - A basic authorization check could prevent the issue: ```js if (order.userID != user.ID) throw Unauthorized; ``` ## Passive Detection and the Limits of Traditional DAST - Cloudflare’s existing API Shield BOLA detection passively analyzes customer traffic for abnormal usage patterns. - Effective passive detection requires context about: - Valid API calls - Variable parameters - Normal user behavior - API responses when parameters are manipulated - Passive analysis may be insufficient in development environments with little traffic or production systems without observed attacks. - DAST creates new traffic specifically for security testing and can operate in environments without relevant user activity. - Traditional DAST tools often: - Require extensive configuration - Depend on manually maintained Swagger/OpenAPI files - Struggle with modern authentication flows - Lack API-specific tests such as BOLA detection ## Cloudflare’s API Scanning Advantage - Scan results will appear in Security Insights alongside other Cloudflare security findings. - API Shield customers already benefit from Cloudflare’s API Discovery and Schema Learning, which catalog endpoints and learn traffic patterns. - The initial release requires an uploaded OpenAPI specification, though future versions are expected to work without one. - Cloudflare can use passive traffic inspection to identify possible BOLA issues and actively verify them with new HTTP requests. - Customers provide API credentials, while Cloudflare uses API schemas to construct a scan plan automatically. ## Stateful API Scanning - Conventional scanners often evaluate requests independently, making it difficult to test vulnerabilities that require a sequence of related actions. - BOLA testing may require: - Creating a resource as one user - Attempting to access or modify it as another user - Comparing the resulting behavior - Cloudflare’s scanner builds an API call graph from the OpenAPI document. - It walks that graph using separate owner and attacker contexts: - Owners create resources. - Attackers use their own valid credentials to attempt access. - This stateful approach is designed to test authorization across realistic API workflows rather than isolated requests. Cloudflare’s scanner is intended to complement—not replace—passive monitoring and edge defenses. Organizations should use the beta to actively test APIs, especially authorization controls, in environments where normal traffic provides insufficient security context.

Read original

Api Security Cloudflare Openapi Vulnerability Scanning+3

datadogSep 20, 20173 min readCurated summary

Secure (and usable) multi-AWS account IAM setup

Managing multiple AWS accounts increases billing, compliance, and operational complexity, but it provides valuable security boundaries between workloads. The post proposes a centralized IAM design in which users exist in only one account, receive minimal default permissions, and temporarily assume narrowly scoped roles in target accounts. MFA and short-lived credentials further limit the impact of compromised credentials, although the approach is constrained to roughly ten accounts by IAM group limitations. ## Why Use Multiple AWS Accounts? - Accounts isolate workloads at several levels: - **Network:** VPCs are separate unless explicitly peered. - **API access:** A compromised account cannot access others without delegated roles. - **Compute and billing:** Per-account spending limits, billing alerts, and CloudTrail monitoring can contain or reveal abuse such as cryptocurrency mining. - The main challenge is gaining these security benefits without creating unmanageable administrative overhead. - The proposed pattern is better suited to production environments than development setups where every developer may have a separate account. - Current IAM group limitations restrict the design to approximately ten accounts. ## Centralized IAM User Management - Each IAM user should exist in only one account. - Centralizing users makes onboarding, offboarding, password policies, and auditing easier. - Other accounts can be monitored for unexpected IAM user creation, which should generally never occur. - Users receive only the permissions needed to manage their own authentication settings. ## Why Use IAM Instead of SSO? - SSO would centralize authentication through an existing identity provider. - However, the post argues that SSO can limit the ability to apply MFA protection precisely to privileged operations. - Since MFA is central to the proposed privilege-escalation model, standalone IAM users are retained despite their administrative drawbacks. ## Minimal Default Permissions By default, users should be able to: - View their own IAM record. - Change their console password. - Create, update, or delete their own API credentials. - Create their own MFA device. They should have no meaningful access to other AWS APIs. This limits the blast radius of stolen usernames, passwords, or API keys: without the user’s MFA device, an attacker can generally do little more than inspect the compromised user’s record. ## Temporary Privilege Through Role Assumption - Users perform privileged work by calling `sts:AssumeRole` in the target account. - Assuming a role provides temporary credentials and a session token. - Credentials have a short lifetime, normally no more than one hour by default. - This resembles the Unix `sudo` model: users begin with restricted permissions and explicitly elevate privileges when necessary. ## MFA-Protected Privilege Escalation A role assumption should succeed only when both conditions are met: - The user has an active MFA device and can authenticate with it. - The user belongs to a group authorized to assume the requested role. MFA does not eliminate compromise risk, but it makes stolen API credentials substantially less useful and limits the damage they can cause without the corresponding MFA device. ## Privileges Grouped by Operational Topic - Administrative capabilities are divided into roles based on responsibility rather than assigning broad account-wide permissions. - Example roles include: - A **VPC role** for network configuration. - An **EC2 role** for instance management. - An **S3 role** for storage administration. - Users can then be mapped to groups and roles according to their job responsibilities, making permissions easier to understand and maintain. ## Practical Recommendation Use multiple AWS accounts as deliberate security boundaries, but centralize IAM users, keep their baseline permissions minimal, require MFA for role assumption, and grant temporary, topic-specific roles. This provides strong isolation while keeping privilege management manageable, particularly for production environments with a limited number of accounts.

Read original

Api Security AWS Iam Mfa+4