AWS Security Tool That Accidentally Introduced a Security Risk

May 5, 2025 · Eliav Livneh

URL: https://www.token.security/blog/aws-built-a-security-tool-it-introduced-a-security-risk

“Since AWS prohibited using the management account as the hub, customers were forced to deploy the hub in a less secure account - often a development, sandbox, or similarly low-sensitivity account.”

AWS built a tool to audit risky cross-account access and told customers to deploy it outside the management account. That opened a path from sandbox accounts into production. AWS only changed the docs. Existing deployments stay exposed until customers find them.