So… You Found AWS Access Keys (Part 1)

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://trustedsec.com/blog/so-you-found-aws-access-keys-part-1
• Blog Title: So… You Found AWS Access Keys (Part 1)
• Suggested Section: AWS Pentesting > AWS - Post Exploitation > AWS - EC2, EBS, SSM & VPC Post Exploitation, with cross-references from AWS - Basic Information and AWS - Unauthenticated Enum & Access

🎯 Content Summary

Scope and security impact

This is a practical AWS cloud penetration-testing guide for determining what leaked access material represents, where additional credentials may be found, and how to validate the permissions of a discovered identity. AWS has more than 200 services, and not all services use identical authentication methods or token formats. The post focuses on long-term IAM access keys, temporary role credentials, S3 presigned URLs, local credential discovery, cloud metadata e...

🔧 Technical Details

Credential-type triage and account discovery: Fingerprint exposed AWS material by its prefix and required components. An AKIA value indicates a long-term IAM-user access key and normally requires the matching 40-character secret. An ASIA value indicates temporary credentials and requires the access key ID, secret access key, and session token. A standalone AKIA identifier cannot normally authenticate but can still be used with account-identification techniques such as the linked Hacking the Cloud method to obtain the associated 12-digit account ID. Treat S3 presigned URLs separately because their embedded key-looking values authorize only the specified object for a limited time.

Local AWS credential harvesting: After obtaining access to a host, inspect ~/.aws/credentials, ~/.aws/config, ~/.aws/sso/, ~/.aws/cli/, environment variables, ~/.bash_history, application logs, and CI/CD ...

🤖 Agent Actions

Plan:

1. Inspect the AWS documentation tree and read at least five relevant pages.
2. Fetch and verify the TrustedSec article and authoritative AWS documentation, excluding forbidden sources.
3. Compare techniques against existing coverage and select one best-fit existing page.
4. Edit, validate citations/references, and review the final diff.
   Repository review is complete. Existing pages already cover key prefixes, CLI profiles, SSO caches, presigned URLs, and basic identity checks, so I’ll avoid duplicating them. The update will add the missing post-compromise workflow—correct workload credential-provider handling and VPC-endpoint/CloudTrail attribution—then add lightweight cross-references from the two suggested entry pages.
   Implemented the HackTricks update.

Changes

• Added a credential recovery and validation workflow to the EC2/EBS/SSM/VPC post-exploitation page:
  • Local AWS credential and cache discovery
  • EC2 IMDSv2 credential retrieval
  • Correct ECS/EKS container credential-provider handling
  • STS identity and access-key account validation
  • VPC endpoint routing and current CloudTrail attribution fields
• Added cross-references from:
  • AWS Basic Information
  • AWS Unauthenticated Enum & Access
• Added numbered citations to TrustedSec and authoritative AWS documentation.
• Excluded all forbidden sources.

Validation

• git diff --check passed.
• Internal links and anchors resolve.
• Added URLs returned HTTP 200.
• Bash snippets passed syntax validation.
• Code blocks comply with the 15-line limit.
• mdbook was unavailable in the environment, so a full build could not be run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://trustedsec.com/blog/so-you-found-aws-access-keys-part-1

Content Categories: Based on the analysis, this content was categorized under "AWS Pentesting > AWS - Post Exploitation > AWS - EC2, EBS, SSM & VPC Post Exploitation, with cross-references from AWS - Basic Information and AWS - Unauthenticated Enum & Access".

Repository Maintenance:

• MD Files Formatting: 814 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0