Amazon Pinpoint SMS and Voice, version 2 Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints

How it was found

████████████Description:████████████ When performing calls to the AWS API, AWS CloudTrail is responsible for logging that API activity for customers. These CloudTrail event logs contain information about the API call, when it was performed, by whom, etc.

███████████We have found 5 API endpoints for the Amazon Pinpoint SMS and Voice, version 2 service that incorrectly report the user-agent and network information as "AWS Internal"████████████. As a result of this, an adversary can perform API calls using these endpoints and evade the logging of their IP address/operating system information.

As a coincidence, these 5 API endpoints are all FIPS endpoints. This is similar to a previous bug we submitted for the Comprehend Medical and Kendra services, leading me to believe this may be a wider issue across a small number of services.

Steps To Reproduce:

First, as a base line, perform the following AWS CLI command:

aws pinpoint-sms-voice-v2 describe-pools

Wait 5-10 minutes for this event to appear in CloudTrail. From here, inspect the CloudTrail log and see that the UserAgent field is populated, as well as the source IP address.

Next, run the following command:

aws pinpoint-sms-voice-v2 describe-pools --endpoint-url █████████

Wait 5-10 minutes for this event to appear in CloudTrail. From here, inspect the CloudTrail log and see that the UserAgent field and network information is "AWS Internal". Because of this endpoint we used, we cannot see the request information which may degrade a defenders ability to track down an adversary.

List of endpoints exhibiting this behavior

███ ███ █████████ █████ █████ ████████ ███ ██████ █████████ ███████

Impact

Summary:

An adversary can use these endpoints to avoid disclosing their source IP address or user agent information to the victim.