Cloud security teams frequently use Cloud Security Posture Management (CSPM) and Cloud-Native Application Protection Platform (CNAPP) tools to identify risky configurations. However, new research by Aryon Security highlights that this method may overlook a significant class of threats: temporary AWS resources that are publicly exposed but removed before the next scan occurs. Aryon refers to this visibility gap as "ShutterGap."
It happens when a cloud resource is made public for a brief period, sometimes lasting only a few minutes. ShutterGap Exposes AWS Resources This issue does not stem from an AWS vulnerability; rather, it is the result of customer configuration errors related to AWS's public-sharing features.
They monitored various AWS resource types supporting public sharing, including Amazon DocumentDB snapshots, Amazon Machine Images, and AWS Systems Manager documents. This data included AWS account identifiers, email addresses, potential secrets, patterns related to private keys, and indicators of financial data. Aryon recommends implementing preventive AWS controls, such as Service Control Policies to block changes to snapshot-sharing attributes, require encryption for new RDS instances, maintain restrictions on public sharing of Amazon Machine Images (AMIs), and enable protections against public sharing of SSM documents.
Security teams should also review AWS CloudTrail logs for public-sharing events, including actions like modifying DB snapshots, changing EC2 image attributes, or altering permissions on SSM documents.
