Security researchers at Datadog Security Labs have uncovered a critical vulnerability in Amazon Web Services (AWS) dubbed “whoAMI.” This new attack vector enables malicious actors to execute code within AWS accounts by exploiting AMI (Amazon Machine Image) naming conventions.

Key Vulnerability Details:
– The attack leverages the AWS Community AMI catalog system
– Affects approximately 1% of monitored organizations
– Impacts code written in multiple languages including Python, Go, Java, Terraform, Pulumi, and Bash

Attack Prerequisites:
1. Use of name filter in AMI searches
2. Missing owner specifications (owner, owner-alias, or owner-id parameters)
3. Selection of most recent image configuration

The vulnerability allows attackers to:
– Create malicious AMIs with targeted naming patterns
– Gain remote code execution capabilities on EC2 instances
– Execute post-exploitation activities

Response and Mitigation:
– Amazon addressed the issue within three days of disclosure (September 19, 2024)
– AWS introduced “Allowed AMIs” feature in December 2024
– HashiCorp Terraform implemented warnings in version 5.77.0
– No evidence of exploitation in the wild reported by AWS

AWS recommends users implement the new Allowed AMIs security control to restrict AMI discovery and usage within their accounts. Future Terraform updates will enforce stricter security measures by converting warnings to errors in version 6.0.0.