AWS Glue Vulnerabilities. What is Your AWS Incident Response Plan. Cyber Security.

AWS Glue Vulnerabilities. What is Your AWS Incident Response Plan. Cyber Security. AWS fixes security flaws allowing access to AWS customer data. Amazon Web Services (AWS) has addressed an AWS Glue security issue that allowed attackers to access and alter data linked to other AWS customer accounts.
AWS Glue is a serverless cloud data integration service that helps discover, prepare, and combine data for app development, machine learning, and analytics. The flaw stemmed from an exploitable AWS Glue feature and an internal service API misconfiguration that allowed Orca Security security researchers to escalate privileges to gain access to all service resources in the region. In combination with an internal misconfiguration in the Glue internal service API, we were able to further escalate privileges within the account to the point where we had unrestricted access to all resources for the service in the region, including full administrative privileges. Serverless is becoming mainstream in business applications to achieve scalability, performance, and cost efficiency without managing the underlying infrastructure. These workloads are able to scale to thousands of concurrent requests per second. One of the most used Serverless functions in cloud environments is the AWS Lambda function