“During February 2024, we discovered critical vulnerabilities in six AWS services.”
CloudFormation quietly creates an S3 bucket named cf-templates, a hash and the region. The hash is the same in every region and all 33 regions are public. An attacker who knows the hash claims the bucket in a region the victim hasn’t used yet, and AWS writes the victim’s templates into it. Aqua reported it in February. AWS took until June to finish the fixes, and only says it will contact customers if they were affected.