AWS to Quick admins: The access control didn't work, but you weren't using it anyway, so what's the problem?

"Most users put up with AWS the way you put up with the DMV. I say this with love, but it's hard to disagree that the UI is awful. The console is a UX time capsule if time capsules weren't allowed to ever look like other time capsules. The pricing pages were designed by someone who hates you personally, and you accept all of it because the one thing AWS has historically gotten right is the boring, important stuff."

"So when Fog Security disclosed an authorization bypass in Amazon Quick on May 12 (that's the BI service formerly known as QuickSight, briefly known as Quick Suite, and now apparently just Quick, but check back next week) and AWS responded with a statement claiming "no customer data was at risk," it's fair to ask which definition of customer data they're using. Because it isn't an obvious one, and it certainly isn't mine."

"Fog reports that when an Amazon Quick administrator (which is an absolutely devastating personal insult) uses "custom permissions" to explicitly deny access to AI Chat Agents, the UI correctly hides the feature. Great! Awesome! I sure wish to hell I could do that with S3 buckets to which I do not have access! Notably, there's no other way for an admin to do this - it's custom permissions or naught."

"The API, however, was perfectly willing to keep answering chat requests for any user in the account who knew how to send them. Fog's proof-of-concept was a non-admin asking the agent "Tell me about mangoes" from a session that was, on paper, locked out of the agent entirely. The agent told them about mangoes. AWS deployed the fix between March 11 and March 12, eight days after Fog reported it via HackerOne."

AWS console usability is described as outdated and frustrating, while pricing and interface design are criticized. Security and IAM are presented as AWS’s key strengths, especially the authorization boundary between accounts. Fog Security reported an authorization bypass in Amazon Quick on May 12, after AWS claimed no customer data was at risk. Fog found that custom permissions could hide AI Chat Agents in the UI for administrators, but the API still answered chat requests for users in the same account who knew how to call it. A non-admin could ask the agent about mangoes and receive responses even when the session was locked out. AWS fixed the issue between March 11 and March 12, eight days after the report via HackerOne.

Read at theregister