Horizon Alert
Summary of the vulnerability and why it matters
A security issue has been identified with the AWS Amplify CLI tool that could potentially allow unauthorized access to AWS resources. This occurred if a specific configuration step was removed from an Amplify project, leaving access controls improperly set. The main concern is confirming if and where this specific configuration scenario may have been implemented within your AWS environment.
- Misconfigured AWS tool access controls.
- Confirms if the tool was used in specific ways.
- Assess exposure and confirm relevance to operations.
Attack Path
How an attacker could exploit the issue
An attacker could gain unauthorized access to an organization's AWS resources if a legitimate user previously removed the Authentication component from an Amplify project. This action improperly configured the trust policy of an AWS Identity and Access Management (IAM) role, allowing any party to assume it. The vulnerability stems from an incomplete removal of specific conditions within the role's trust policy, which then permits `sts:AssumeRoleWithWebIdentity` actions without necessary restrictions.
- Requires authenticated user to remove a component.
- Vulnerable role trust policy allows unrestricted role assumption.
- Risk of unauthorized access to cloud resources.
Live Threat
Current exploitation, exposure, and threat context
When the Authentication component is removed from an Amplify project, the associated IAM roles' trust policy may be misconfigured, potentially allowing unauthorized access to an organization's AWS resources if the Amplify CLI was used to remove the component between August 2019 and January 2024.
- AWS resources.
- Role trust policy misconfiguration.
- Unauthorized access to AWS resources.
Operational Fix
Recommended remediation, mitigation, and detection steps
This critical vulnerability impacts AWS Amplify projects where the Authentication component was removed. Ownership likely falls to the application or platform teams responsible for AWS resource configuration and development tool management. The initial step is to identify all Amplify projects, assess which may have had the Authentication component removed, and confirm if the affected CLI version was used. Subsequently, a risk-based remediation plan should be developed in coordination with security and vendor management teams, if applicable.
- Application and platform teams own remediation.
- Verify Amplify projects and CLI usage.
- Plan risk-based remediation actions.
