Data exfiltration with native AWS S3 features

Malicious actors are exploiting legitimate features like data replication in AWS to exfiltrate data.

This article suggests ways to detect and prevent abuse of these features, including monitoring IAM policies, bucket policies, and CloudTrail logs.

The article recommends using AWS Security Hub, restrict outbound network connections, and disable ACLs. Access points and VPC endpoints are also discussed.

>>Stay vigilant and keep evaluating and reacting to changes.