{"id":48789,"date":"2026-07-06T18:29:38","date_gmt":"2026-07-06T16:29:38","guid":{"rendered":"https:\/\/www.cloudmagazin.com\/2026\/07\/11\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/"},"modified":"2026-07-11T14:31:57","modified_gmt":"2026-07-11T12:31:57","slug":"8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin","status":"publish","type":"post","link":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/","title":{"rendered":"8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin&#8230;"},"content":{"rendered":"<p style=\"color:#0bb7fd;font-size:0.9em;margin:0 0 16px;padding:0;\">6 Min. Reading time<\/p>\n<p><strong>On November 28, 2025, an attacker seized a full AWS account in just eight minutes, moving from the first stolen access key to full administrator privileges. The incident was documented by Sysdig\u2019s security team. What makes it striking is the speed: an AI completed the investigation and script creation in real time. The initial foothold was a well\u2011known configuration error.<\/strong><\/p>\n<h2>The Essentials in Brief<\/h2>\n<ul>\n<li><strong>Eight minutes to admin:<\/strong> According to Sysdig, an attacker compromised an AWS account in under ten minutes, moving from stolen keys in an open S3 bucket to a self\u2011created admin user.<\/li>\n<li><strong>The flaw was in the config:<\/strong> A Lambda function carried an execution role with administrator rights. Whoever was allowed to rewrite the function inherited those rights. A new exploit was not needed.<\/li>\n<li><strong>The AI was the turbo:<\/strong> It wrote attack code and explored the account in real time. The industry median for attacks, according to Mandiant, is still 14 days. The eight\u2011minute case is the exception with special circumstances.<\/li>\n<\/ul>\n<p style=\"font-size:0.88em;color:#666;margin:20px 0 32px 0;border-top:1px solid #e5e5e5;border-bottom:1px solid #e5e5e5;padding:10px 0;\"><span style=\"font-family:'SF Mono','Monaco','Consolas',monospace;color:#0879aa;font-weight:700;text-transform:uppercase;font-size:0.72em;letter-spacing:0.14em;margin-right:14px;\">Related:<\/span><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/18-months-without-a-fix-how-an-argo-cd-vulnerability-exposed-the-entire\/\" style=\"color:#333;text-decoration:underline;\">How an Argo CD vulnerability opens the entire cluster<\/a>&nbsp;&nbsp;<span style=\"color:#ccc;\">\/<\/span>&nbsp;&nbsp;<a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/06\/28\/aws-und-azure-unter-eu-aufsicht-der-lock_in-wackelt\/\" style=\"color:#333;text-decoration:underline;\">AWS and Azure under EU oversight<\/a><\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">Eight minutes from the S3 bucket to the admin key<\/h2>\n<p>The entry was openly accessible on the network. In a publicly reachable S3 bucket, training data for an AI (Artificial Intelligence) system was stored, including valid access keys of an IAM (Identity and Access Management) user. This user was allowed to do little, but a single permission was sufficient: he could modify the code of a specific Lambda function. The function was called EC2-init. It was attached to an execution role with administrative rights.<\/p>\n<p>From here everything moved quickly. The attacker modified the function, had it generate new access keys for an admin user named frick and read the result directly from the function&#8217;s response. No detour via an external server, no reverse shell. Subsequently, he accessed 19 different AWS identities, created a second backdoor admin, and secured the access multiple times.<\/p>\n<p>Then it got expensive. Via the AI service Amazon Bedrock, the attacker tapped foreign language models at the victim&#8217;s expense. At the same time, he launched a GPU instance for around 30 Euro per hour to run his own models. AWS terminated the instance after five minutes due to capacity limits. Suspiciously, the code itself: Serbian comments and fabricated AWS account numbers revealed that a language model had helped write it.<\/p>\n<div class=\"evm-stat-highlight\" style=\"text-align:center;background:#004a59;border-radius:12px;padding:40px 24px;margin:32px 0;\">\n<div style=\"font-size:48px;font-weight:700;color:#0bb7fd;letter-spacing:-0.03em;line-height:1;\">8 minutes<\/div>\n<div style=\"font-size:15px;color:#fff;margin-top:12px;max-width:460px;margin-left:auto;margin-right:auto;line-height:1.5;\">took the observed attack from the stolen key to admin access. An exception case with long\u2011lived keys and an admin role in the wrong place.<\/div>\n<div style=\"font-size:12px;color:#0bb7fd;margin-top:12px;\">Source: Sysdig Threat Research Team, Incident from 28. November 2025<\/div>\n<\/div>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">No Zero-Day, but a Chain of Known Vulnerabilities<\/h2>\n<p>The \u201ceight\u2011minute\u201d figure may sound like a rupture of everything you thought you knew about cloud security. Yet a closer look at the attack chain tells a different story. There is no zero\u2011day, no AI\u2011specific exploit-just a string of well\u2011known misconfigurations.<\/p>\n<p>Long\u2011lived access keys were stored in a public bucket. A Lambda execution role carried administrator privileges, even though it never needed them. A low\u2011privilege user could overwrite foreign code. These three errors together formed the chain. Each one, on its own, has been known for years and is listed in every AWS hardening guide.<\/p>\n<p>AI accelerated and automated the attack. It did not enable it. Anyone who reads the case as proof that AI is making cloud insecure misses the real cause-and the point where defenders can act. The root cause is fixable, completely independent of AI\u2011based defenses.<\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">Why the Minute Count Is Misleading<\/h2>\n<p>A second data point puts the matter in perspective. Google&#8217;s security unit Mandiant analyzes hundreds of thousands of hours of incident response each year. In the M\u2011Trends 2026 report dated March 23, there is a statement that contradicts panic: Do not regard 2025 as the year when attacks first emerged directly from AI.<\/p>\n<p>The numbers back this up. The median dwell time of an attacker in the network rose to 14 days in 2025, up from 11 the previous year. In 52 percent of cases, companies detected the breach themselves first. Exploited vulnerabilities remain the most common entry vector, accounting for 32 percent, for the sixth consecutive year. Most attacks still unfold on a timescale of days and weeks.<\/p>\n<p>The eight\u2011minute case is real, but it is an outlier, not a new average. It happened so quickly only because the conditions were ideal. For defenders, this is the good news: Anyone who eliminates those conditions removes the basis for a rapid attack.<\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">Five Steps to Harden AWS Accounts Now<\/h2>\n<p>No vendor patch resolves the issue, as it stems from the configuration. That&#8217;s precisely where it can be addressed. The sequence is ordered by impact.<\/p>\n<ol>\n<li style=\"margin-bottom:10px;\"><strong>Retire long-lived credentials.<\/strong> Instead of permanent IAM credentials, short-lived roles and temporary login credentials should be used in regular operations. A leaked key that becomes worthless after one hour no longer opens any doors.<\/li>\n<li style=\"margin-bottom:10px;\"><strong>Separate administrative privileges from execution roles.<\/strong> No Lambda function needs administrator rights to perform its task. Each execution role should receive exactly the permissions required for its function, nothing more.<\/li>\n<li style=\"margin-bottom:10px;\"><strong>Identify public Amazon S3 buckets.<\/strong> Amazon S3 buckets containing training data often end up accidentally exposed on the internet. A regular scan for open buckets and embedded credentials closes the most common entry point.<\/li>\n<li style=\"margin-bottom:10px;\"><strong>Secure Amazon Bedrock with guardrails.<\/strong> Service Control Policies limit who may initiate costly AI services and GPU instances. This caps the damage if an account is compromised.<\/li>\n<li><strong>Monitor activity.<\/strong> New admin users, foreign Bedrock calls, and suddenly started GPU instances are clear signals. Whoever sees them in real time stops the attack mid\u2011run.<\/li>\n<\/ol>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">Misconfiguration vs Hardened Setup<\/h2>\n<p>The difference between the eight-minute account and a secure environment is not in a new tool. It lies in settings that you must know and apply.<\/p>\n<div style=\"overflow-x:auto;-webkit-overflow-scrolling:touch;margin:16px 0 32px 0;\">\n<table style=\"width:100%;min-width:560px;border-collapse:collapse;font-size:0.95em;\">\n<thead>\n<tr style=\"background:#004a59;color:#fff;\">\n<th style=\"padding:12px 16px;text-align:left;border:1px solid #004a59;\">Aspect<\/th>\n<th style=\"padding:12px 16px;text-align:left;border:1px solid #004a59;\">The vulnerable case<\/th>\n<th style=\"padding:12px 16px;text-align:left;border:1px solid #004a59;\">Hardened Setup<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\"><strong>Access key<\/strong><\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\">long-lived, in an open bucket<\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;color:#004a59;font-weight:600;\">short-lived roles<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\"><strong>Lambda execution role<\/strong><\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\">Administrative rights<\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;color:#004a59;font-weight:600;\">only functional rights<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\"><strong>S3 Buckets<\/strong><\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\">public with credentials<\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;color:#004a59;font-weight:600;\">private, regularly scanned<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\"><strong>Effect of a leaked key<\/strong><\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\">Path to account admin<\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;color:#004a59;font-weight:600;\">worthless after one hour<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">What Teams Take From the Incident<\/h2>\n<p>The fuss over the eight minutes distracts from the real finding. The attack was swift because basic hygiene was lacking. Short-lived credentials, sparingly assigned roles, and a look at open buckets could have broken the chain at every step. These measures are old, unremarkable, and effective.<\/p>\n<p>One detail should jolt defenders as well. Sysdig warns that the tell\u2011tale AI traces in the code will soon disappear. Better agents don\u2019t write Serbian comments and no longer invent account numbers. The window in which a AI\u2011driven attack can be detected in the code is closing. Staying hardened, which already throttles each of these steps today, remains crucial.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently Asked Questions<\/h2>\n<details>\n<summary><strong>What is LLMjacking?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">In LLMjacking, attackers hijack stolen cloud access to run expensive language models via services such as Amazon Bedrock. The bill is footed by the victim. In the Sysdig case, the attacker also tapped into foreign models and launched an additional GPU instance at the victim&#8217;s expense.<\/p>\n<\/details>\n<details>\n<summary><strong>Does the eight\u2011minute figure come from Google or GTIG?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">No. The specific eight\u2011minute figure originates from Sysdig&#8217;s security team. Google&#8217;s Mandiant M\u2011Trends 2026 report provides context and cites a median dwell time of 14 days. Together, the two sources give the full picture.<\/p>\n<\/details>\n<details>\n<summary><strong>Was an unknown vulnerability involved?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">No. The attack relied solely on misconfigurations: long\u2011lived keys in an open S3 bucket and a Lambda role with admin privileges. No zero\u2011day was involved, and no patch is required.<\/p>\n<\/details>\n<details>\n<summary><strong>What is the fastest mitigation step?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The fastest mitigation step is to replace long\u2011lived IAM keys with short\u2011lived roles and never grant admin privileges to Lambda execution roles. This removes both the initial foothold and the ability to pivot to admin for the observed attack.<\/p>\n<\/details>\n<div style=\"margin:40px 0;padding:0;border-top:2px solid #004a59;\">\n<p style=\"margin:0;padding:16px 0 8px 0;font-size:0.78em;font-weight:700;text-transform:uppercase;letter-spacing:0.18em;color:#004a59;\">Editor&#8217;s Picks<\/p>\n<ul style=\"list-style:none;margin:0;padding:0;\">\n<li style=\"padding:10px 0;border-bottom:1px solid #eee;\"><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/06\/29\/kritis-in-the-cloud-what-secures-the-migration\/\" style=\"color:#1a1a1a;text-decoration:none;\">Critical Infrastructure in the Cloud: What Secures the Migration<\/a><\/li>\n<li style=\"padding:10px 0;border-bottom:1px solid #eee;\"><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/06\/24\/ingress-nginx-is-discontinued-the-path-to-gateway-api\/\" style=\"color:#1a1a1a;text-decoration:none;\">Ingress-NGINX Is Deprecated: The Path to the Gateway API<\/a><\/li>\n<li style=\"padding:10px 0;\"><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/06\/26\/finops-realistically-reducing-cloud-costs-by-30-percent\/\" style=\"color:#1a1a1a;text-decoration:none;\">FinOps: Realistically Cutting 30 Percent of Cloud Costs<\/a><\/li>\n<\/ul>\n<\/div>\n<div style=\"margin:40px 0 24px 0;\">\n<p style=\"margin:0 0 12px 0;font-size:0.78em;font-weight:700;text-transform:uppercase;letter-spacing:0.18em;color:#666;\">More from the MBF Media Network<\/p>\n<div style=\"padding:14px 18px;border-left:3px solid #69d8ed;background:#fafafa;margin-bottom:6px;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#69d8ed;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">securitytoday<\/div>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/07\/02\/state-of-vulnerabilities-report-2026-schwachstellen-tempo\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">When Attackers Outpace the Patch<\/a><\/p>\n<\/div>\n<div style=\"padding:14px 18px;border-left:3px solid #202528;background:#fafafa;margin-bottom:6px;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#202528;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">mybusinessfuture<\/div>\n<p><a href=\"https:\/\/mybusinessfuture.com\/die-ki-aufsicht-in-deutschland-hat-jetzt-eine-adresse\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">The AI Regulator in Germany Now Has an Address<\/a><\/p>\n<\/div>\n<div style=\"padding:14px 18px;border-left:3px solid #d65663;background:#fafafa;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#d65663;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">digital-chiefs<\/div>\n<p><a href=\"https:\/\/www.digital-chiefs.de\/hyperscaler-ai-capex-cio-cloud-budget-strategie\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">The Billion\u2011Dollar Bet of the Hyperscalers and Your Cloud Bill<\/a><\/p>\n<\/div>\n<p style=\"text-align:right;\"><em>Image source: AI-generated (Juli 2026)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"An attacker took over an AWS account in eight minutes, according to Sysdig. The path went through an open S3 bucket and a Lambda role with admin rights. The AI only accelerated the attack.","protected":false},"author":31,"featured_media":48484,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/07\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/07\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg","_yoast_wpseo_twitter-image-id":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[964,979],"tags":[],"industry":[],"class_list":["post-48789","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-cm-security"],"evm_reading_time_minutes":8,"wpml_language":"en","wpml_translation_of":48476,"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin... - cloudmagazin<\/title>\n<meta name=\"description\" content=\"8 minutes from open S3 bucket to AWS admin: What the Sysdig case shows about AI-accelerated cloud attacks and how teams now harden.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin... - cloudmagazin\" \/>\n<meta property=\"og:description\" content=\"8 minutes from open S3 bucket to AWS admin: What the Sysdig case shows about AI-accelerated cloud attacks and how teams now harden.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/\" \/>\n<meta property=\"og:site_name\" content=\"cloudmagazin\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cloudmagazincom\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-06T16:29:38+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-11T12:31:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/07\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg\" \/>\n<meta name=\"author\" content=\"Alec Chizhik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/07\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg\" \/>\n<meta name=\"twitter:creator\" content=\"@cloudmagazin\" \/>\n<meta name=\"twitter:site\" content=\"@cloudmagazin\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alec Chizhik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/\"},\"author\":{\"name\":\"Alec Chizhik\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/person\\\/ce38baaa19a580268aedce096597eb3c\"},\"headline\":\"8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin&#8230;\",\"datePublished\":\"2026-07-06T16:29:38+00:00\",\"dateModified\":\"2026-07-11T12:31:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/\"},\"wordCount\":1388,\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg\",\"articleSection\":[\"Security\",\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/\",\"name\":\"8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin... - cloudmagazin\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg\",\"datePublished\":\"2026-07-06T16:29:38+00:00\",\"dateModified\":\"2026-07-11T12:31:57+00:00\",\"description\":\"8 minutes from open S3 bucket to AWS admin: What the Sysdig case shows about AI-accelerated cloud attacks and how teams now harden.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg\",\"width\":1792,\"height\":1024,\"caption\":\"Clean flat textfree editorial infographic of a four-step cloud attack path, arranged left to right connected by clear arrows: (1) an open st\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/07\\\/06\\\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/home\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin&#8230;\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/\",\"name\":\"cloudmagazin\",\"description\":\"Inspiration f\u00fcr Businessentscheider\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\",\"name\":\"cloudmagazin\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cloudmagazin-logo-klein_menu.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cloudmagazin-logo-klein_menu.jpg\",\"width\":150,\"height\":150,\"caption\":\"cloudmagazin\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cloudmagazincom\\\/\",\"https:\\\/\\\/x.com\\\/cloudmagazin\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/cloudmagazin\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/person\\\/ce38baaa19a580268aedce096597eb3c\",\"name\":\"Alec Chizhik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"caption\":\"Alec Chizhik\"},\"description\":\"Alec is the Chief Digital Officer at Evernine and writes about cloud architectures, IT security, and digital operations practices.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/alecchizhik\\\/\"],\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/author\\\/alec\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin... - cloudmagazin","description":"8 minutes from open S3 bucket to AWS admin: What the Sysdig case shows about AI-accelerated cloud attacks and how teams now harden.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/","og_locale":"en_US","og_type":"article","og_title":"8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin... - cloudmagazin","og_description":"8 minutes from open S3 bucket to AWS admin: What the Sysdig case shows about AI-accelerated cloud attacks and how teams now harden.","og_url":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/","og_site_name":"cloudmagazin","article_publisher":"https:\/\/www.facebook.com\/cloudmagazincom\/","article_published_time":"2026-07-06T16:29:38+00:00","article_modified_time":"2026-07-11T12:31:57+00:00","og_image":[{"url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/07\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg","type":"","width":"","height":""}],"author":"Alec Chizhik","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/07\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg","twitter_creator":"@cloudmagazin","twitter_site":"@cloudmagazin","twitter_misc":{"Written by":"Alec Chizhik","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/#article","isPartOf":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/"},"author":{"name":"Alec Chizhik","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/person\/ce38baaa19a580268aedce096597eb3c"},"headline":"8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin&#8230;","datePublished":"2026-07-06T16:29:38+00:00","dateModified":"2026-07-11T12:31:57+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/"},"wordCount":1388,"publisher":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#organization"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/07\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg","articleSection":["Security","Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/","url":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/","name":"8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin... - cloudmagazin","isPartOf":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/#primaryimage"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/07\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg","datePublished":"2026-07-06T16:29:38+00:00","dateModified":"2026-07-11T12:31:57+00:00","description":"8 minutes from open S3 bucket to AWS admin: What the Sysdig case shows about AI-accelerated cloud attacks and how teams now harden.","breadcrumb":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/#primaryimage","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/07\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/07\/aws-admin-acht-minuten-s3-bucket-lambda-cover-hero-1.jpg","width":1792,"height":1024,"caption":"Clean flat textfree editorial infographic of a four-step cloud attack path, arranged left to right connected by clear arrows: (1) an open st"},{"@type":"BreadcrumbList","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/06\/8-minutes-to-aws-admin-how-an-open-s3-bucket-and-an-admin\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cloudmagazin.com\/en\/home\/"},{"@type":"ListItem","position":2,"name":"8 Minutes to AWS Admin: How an Open S3 Bucket and an Admin&#8230;"}]},{"@type":"WebSite","@id":"https:\/\/www.cloudmagazin.com\/en\/#website","url":"https:\/\/www.cloudmagazin.com\/en\/","name":"cloudmagazin","description":"Inspiration f\u00fcr Businessentscheider","publisher":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cloudmagazin.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.cloudmagazin.com\/en\/#organization","name":"cloudmagazin","url":"https:\/\/www.cloudmagazin.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2020\/04\/cloudmagazin-logo-klein_menu.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2020\/04\/cloudmagazin-logo-klein_menu.jpg","width":150,"height":150,"caption":"cloudmagazin"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cloudmagazincom\/","https:\/\/x.com\/cloudmagazin","https:\/\/www.linkedin.com\/showcase\/cloudmagazin\/"]},{"@type":"Person","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/person\/ce38baaa19a580268aedce096597eb3c","name":"Alec Chizhik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","caption":"Alec Chizhik"},"description":"Alec is the Chief Digital Officer at Evernine and writes about cloud architectures, IT security, and digital operations practices.","sameAs":["https:\/\/www.linkedin.com\/in\/alecchizhik\/"],"url":"https:\/\/www.cloudmagazin.com\/en\/author\/alec\/"}]}},"_links":{"self":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/48789","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/comments?post=48789"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/48789\/revisions"}],"predecessor-version":[{"id":48806,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/48789\/revisions\/48806"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/media\/48484"}],"wp:attachment":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/media?parent=48789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/categories?post=48789"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/tags?post=48789"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/industry?post=48789"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}