🧰 AWS CLI

The items that name it 15

• The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub
  writeupas tools2026-09-29It is written here as aws-cli.

  Command-line tool used by the attacker to interact with AWS, in contrast to the account's normal aws-sdk-go usage

• ICYMI: August 2026 @AWS Security
  articleas affected products2026-09-23
• Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline
  writeupas tools2026-09-15

  Used to delete secrets, log groups, and analyzers during cleanup; also a method roles can be manually created through

• Incident response guide for AWS CloudTrail investigations – Part 1 | Amazon Web Services
  writeupas tools2026-09-03

  Command line tool identified via user-agent string as used by threat actor to script the S3 object deletions

• Managing identity source transition for AWS IAM Identity Center
  writeupas tools2026-09-02

  Configure AWS credentials for running migration scripts

• IAM Policy Autopilot
  repoas tools2026-08-25

  Used to configure AWS credentials required by IAM Policy Autopilot to apply policy fixes and upload policies for AccessDenied debugging

• JFrog: Propagating User Identity From AI Agents to Your Tools
  articleas tools2026-08-21

  Used to create the OAuth2 credential provider and gateway target, and to attach the IAM policy.

• S3 Clones in the Neoclouds
  writeupas tools2026-07-31

  Used to interact with S3 and S3-compatible clone APIs via configured access key, secret key, region, and custom endpoint URL

• DataDog/pathfinding-labs
  repoas tools2026-07-04

  Used with named profiles to configure and interact with AWS accounts for the labs

• MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension
  writeupas tools2026-06-26It is written here as AWS CLI (aws sts get-caller-identity).

  Used in the PoC to demonstrate capturing the developer's active AWS session/credentials

• AWS Well-Architected: Software Supply Chain Security
  articleas tools2026-06-04It is written here as AWS CLI (aws login).

  New command simplifying acquisition of short-lived CLI credentials, removing need to store long-lived credentials in config files

• Observing Privilege Escalation in Kubernetes (EKS CloudWatch Observability Add-on)
  writeupas tools2026-06-01It is written here as AWS CLI (aws eks).

  Used to create/update/describe the EKS add-on (eks create-addon, eks update-addon, eks describe-addon) and manage cluster configuration

• AWS MCP Server (GA)
  articleas affected products2026-05-24
• AWS Ransomware
  writeupas affected products2024-02-21

  Victim needed to be authenticated into aws-cli with credentials per the ransom note's fake recovery instructions

• AWSHound — AWS BloodHound OpenGraph Collector
  repoas tools

  Provides named profiles used for authenticating and selecting accounts to collect

In every workspace you can read 16