low
Partial CloudTrail logging in AWS Control Tower
Published Mon, Mar 20th, 2023
Platforms
Summary
AWS Control Tower was not properly logging to CloudTrail when API calls failed due to a lack of permissions. This could have helped an adversary with existing access to a victim AWS environment avoid detection while enumerating privileges, since any unsuccessful API calls would not generate "access denied" log entries.
Affected Services
Control Tower
Remediation
None required
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/frichetten
Entry Status
Finalized
Disclosure Date
Mon, Jan 30th, 2023
Exploitability Period
Until 2023/02/13
Known ITW Exploitation
-
Detection Methods
None
Piercing Index Rating
-
Discovered by
Nick Frichette, Datadog
