Image: images.ctfassets.net · rights & removal

Hijacking Amazon EventBridge for launching Cross

Reporting by Square EngineeringRead the original at developer.squareup.com

Executive Summary

Cross-account EventBridge configurations facilitate legitimate service-to-service communication but introduce security risks related to data infiltration and exfiltration. Attackers can exploit these capabilities via six distinct patterns: Persistent Beaconing, Command and Control, Reconnaissance, Data Exfiltration, Cross-Account Movement, and Event Consumer Input Validation Bypass. Infiltration risk involves sending untrusted events into an organization's accounts, while exfiltration risk involves using EventBridge to sneak data out in small chunks that evade traditional monitoring. The specific attack vectors demonstrate that legitimate architectural features can be repurposed for stealthy command execution, passive reconnaissance of infrastructure, and the movement of access across organizational boundaries.

Facts Only

* Cross-account EventBridge setups involve Source Accounts and Destination Accounts.
* The architecture includes Event Rules, Event Targets (e.g., SNS, SQS, Lambda), IAM Roles, and Event Buses.
* Infiltration involves sending events from untrusted accounts into organizational accounts to trigger processes.
* Exfiltration involves forwarding sensitive data in small chunks via EventBridge events to external accounts or services.
* Attack 1 (Beaconing) involves a compromised Lambda sending regular "check-in" events via EventBridge.
* Attack 2 (C2) uses EventBridge for bidirectional communication, sending commands and receiving results through event flows.
* Attack 3 (Reconnaissance) involves creating rules to capture all events flowing through the victim's EventBridge.
* Attack 4 (Exfiltration) involves breaking sensitive data into small chunks and sending them as disguised telemetry events.
* Attack 5 (Account Hopping) exploits cross-account rules and roles for pivoting between accounts using re-emitted events.
* Attack 6 (API Borrowing) involves a vulnerable Lambda processing EventBridge input to execute unintended AWS API calls based on event data from partner accounts.
* Preventive controls include Service Control Policies (SCPs), IAM permissions, Resource Control Policies (RCPs), and VPC Endpoints.

Full Take

The core tension in this narrative lies between the architectural utility of EventBridge for decoupled systems and its potential as an undetectable control plane for malicious activity. The attack patterns demonstrate that exploiting cross-account trust relationships moves beyond simple network intrusion; it targets the service layer itself, leveraging trusted service communication to achieve persistence and lateral movement. The distinction between internal process compromise (like Attack 1 or 6) and cross-account pivoting (Attack 5) highlights a layered defense failure where perimeter security is insufficient.
The mechanism of EventBridge acting as an unlogged data plane for control—specifically the lack of CloudTrail logging on `PutEvents` calls—is a critical assumption that attackers rely upon. This transforms the event bus from a monitored communication channel into a potential blind spot where low-volume, carefully constructed messages become invisible to conventional monitoring. The defensive recommendations correctly focus on restricting flow (SCPs/RCPs) and inspecting content (validation). The implication is that securing modern distributed systems requires treating inter-account event flows with the same scrutiny applied to network traffic, recognizing that legitimate architectural patterns can be weaponized when trust boundaries are improperly established or application logic lacks sufficient validation.
What if the assumption that custom sources like `system.monitor` are inherently safe is breached? If an attacker can successfully blend malicious payloads into these innocuous structures, detection shifts entirely to behavioral analysis rather than signature matching for data egress. This pushes the defensive strategy toward establishing extremely narrow, context-aware policies and implementing deep content inspection within the event processing logic itself, acknowledging that control in this ecosystem rests not just on IAM boundaries but on verifiable application fidelity.
What assumptions about the inherent trust in cross-account roles should be questioned? If a role is configured to allow an action across accounts for CI/CD or telemetry purposes, does that configuration inherently grant undue power during a compromise, even if the immediate activity looks benign? How can organizations move from simply denying unauthorized flows to proactively verifying the *intent* behind authorized EventBridge interactions?

From the original · Square Engineering

Account attacks Securing the invisible paths: How cross-account event flows can become security blind spots AWS EventBridge is a serverless event bus service that enables powerful integrations across multiple AWS accounts. While this cross-account capability is essential for building modern, decoupled architectures, it also introduces potential security risks when not properly configured.

Read the full story at developer.squareup.com

Sentinel — Human

Confidence

This analysis provides a technically sound breakdown of EventBridge security risks, utilizing expert-level threat modeling and precise AWS controls, strongly suggesting human authorship grounded in deep operational knowledge.

Signals Detected

Sentence length variance is moderate, but the dense technical sections use very structured, almost programmatic sentence construction.

High coherence. The text flows logically from architecture to risk to specific attack patterns and finally to controls without significant vacillation.

Strong pattern matching found in the structured enumeration of attacks (Attacks 1-6) and the final control recommendations, resembling textbook or compiled threat intelligence summaries.

The technical details, specific API calls, MITRE ATT&CK mappings, and proposed security controls (SCPs, RCPs, VPC Endpoints) are highly accurate and reflect current AWS security best practices, suggesting deep domain knowledge.

Human Indicators

The incorporation of specific, complex, and layered architectural defense mechanisms (SCPs, RCPs, granular IAM policies) demonstrates a depth of practical engineering experience that goes beyond typical LLM summarization.

The narrative transitions between abstract concepts (event flow) and concrete exploitation methods (Attack 1-6), embedding procedural knowledge characteristic of security analysts or advanced writers.