This article highlights key security updates announced before AWS re:Invent 2025, focusing on AWS local development with console credentials, IAM outbound identity federation, and attribute-based access control for S3. It discusses the benefits of these features, potential risks for attackers, and monitoring strategies using CloudTrail.

The article discusses the integration of AWS VPC endpoints with AWS CloudTrail, highlighting how this setup enhances security and monitoring by enabling users to log and audit VPC endpoint activity. It also provides insights into the benefits of using CloudTrail for tracking API calls made by VPC endpoints, ensuring compliance and better resource management.

The article discusses methods for enumerating AWS resources quietly and efficiently using CloudTrail and Resource Explorer. It highlights the advantages of utilizing these tools for discovery while minimizing detection risks. Best practices and tips for leveraging these AWS services are also covered to enhance security assessments.

Attackers can exploit AWS CodeBuild to gain long-term access to compromised accounts by configuring it as a GitHub Actions runner and backdooring an IAM role. This process allows them to persistently execute commands in the AWS environment, even after the original credentials are revoked. Defenders must monitor CloudTrail logs and audit IAM trust relationships to detect such abuses.

The article discusses the concept of CloudTrail logging evasion in AWS, emphasizing the importance of policy size when creating effective logging mechanisms. It highlights how attackers can exploit insufficiently sized policies to avoid detection and the need for robust configurations to enhance security.