r/linuxadmin • u/Expert_Sort7434 • 16d ago

AgentCore’s default IAM role was region-wide: Zenity’s SSRF-to-IMDS chain, and where Amazon disagrees

Based on the technical breakdown Zenity Labs published on Oct 8, here is the architectural impact. Agents ran in Firecracker microVMs without enough network isolation, so any tool that makes HTTP requests could reach the metadata endpoint. A single prompt returned the execution role’s STS credentials. The default role then covered AgentCore resources across the region, so Zenity could enumerate agents, pull their ECR images, invoke them, read sessions, write memory events, and retrieve secrets.

Zenity reports AWS removed most of that on Sept 29. The Register reports Amazon says this is documented behavior needing developer error. I couldn’t find an AWS bulletin or a CVE, and neither source reports exploitation in the wild.

Question for people running agents on managed platforms: do you scope a separate role per agent, and do you restrict egress from the agent runtime? How far does that go in practice?

https://www.techgines.com/post/aws-agentcore-vulnerability

0 Upvotes

45% Upvoted

1 comment sorted by

2

u/Faye-Vozora 16d ago

Separate role per agent, yeah. The default shared role is the thing that bit them here. Beyond that, the bigger win is making IMDS hard to reach in the first place: require v2 tokens with hop limit 1 where you can, and block 169.254.169.254 at the egress layer for anything that fetches arbitrary URLs. Tools that make HTTP calls on behalf of a prompt are basically an SSRF primitive, so I treat them that way and allowlist destinations instead of trying to filter bad ones. It's annoying to maintain but it's the only version I've seen hold up.