Orca Security: GenAI Risks in Cloud Environments

What it is

Orca's post on GenAI cloud risk. The catalog summary already carries the four asset classes, the S3→poisoning→credential-theft→account-wide-read attack chain, and the CVE-2024-34359 safetensors path. What it does not carry are the specific, verbatim hardening configurations and version/control boundaries the page prescribes — that's the reason to read further.

What to do

The page gives an ordered pre-production hardening sequence with exact controls:

• Scope the execution role. Replace AmazonSageMakerFullAccess (which grants s3:*, iam:PassRole for any role, and ecr:*) with a policy granting only s3:GetObject and s3:ListBucket on the exact bucket ARN and prefix. Remove iam:PassRole unless explicitly required. Maps to CIS AWS Foundations Benchmark v3.0 control 1.16.
• Enforce IMDSv2 at the org level. Set HttpTokens: required on all EC2 training instances, and add an Organizations SCP denying ec2:RunInstances where MetadataHttpTokens is not required — so no team can launch a training instance without it.
• Fence the endpoint. Add a resource-based policy to every SageMaker endpoint denying calls from outside the account and outside the designated VPC, using an aws:SourceVpc condition with the specific VPC ID. Orca classifies any endpoint lacking this condition as internet-exposed regardless of DNS.
• Lock artifacts. Enable S3 Object Lock in governance mode on model-artifact and training-data buckets. Overwriting a locked object then requires s3:BypassGovernanceRetention, which the page says should be granted to zero service accounts. This is the structural fix for the CVE-2024-34359 path, distinct from patching.

Preconditions / Affected

• CVE-2024-34359 affects Hugging Face safetensors prior to 0.4.3 — arbitrary code execution during deserialization despite safetensors being marketed as safer than pickle. Any SageMaker or self-hosted endpoint that pulled safetensors files from a shared, publicly-writable S3 bucket before 0.4.3 was exposed; the attacker needs only bucket write access, not endpoint access. Immediate fix is upgrading to 0.4.3.
• The reconnaissance step maps to MITRE ATLAS AML.T0037 (Search for Victim's Publicly Available Research), preceding the AML.T0020 poisoning already noted in the summary.

Caveats

The endpoint-exposure check "does not exist in CIS AWS Foundations Benchmark v3.0" — the benchmark predates widespread SageMaker deployment, so compliance-clean environments can still miss it. Detection specifics beyond this are the standard vendor pitch for Orca's agentless SideScanning and attack-path correlation.