Pivoting Clouds in AWS Organizations - Scott Weston

Abstract: AWS Organizations is a service offered by AWS that allows a user to logically bind together a large number of AWS accounts under one “organization”. While this helps for organizational purposes, it presents several unique pathways for a pentester allowing one to tunnel through the inherent boundaries that might exist in a single AWS account. Using AWS Organizations, I show how one can turn a single account takeover into a multi-account takeover drastically increasing the blast radius. The talk …

accounts aws aws organizations bind clouds large organization organizations pentester pivoting service tunnel under