AWS Auto Scaling Service Reporting "AWS Internal" for CloudTrail Events Generated from Specific Endpoints

How it was found

When performing calls to the AWS API, AWS CloudTrail is responsible for logging that API activity for customers. These CloudTrail event logs contain information about the API call, when it was performed, by whom, etc.

We have found 6 API endpoints for the AWS Auto Scaling service that incorrectly report the user-agent and network information as "AWS Internal". As a result of this, an adversary can perform API calls using these endpoints and evade the logging of their IP address/operating system information.

This is similar to previous bugs we've submitted for the following services:

• Pinpoint SMS and Voice
• Kendra
• Comprehend Medical

Steps To Reproduce:

First, as a base line, perform the following AWS CLI command:

███

Wait 5-10 minutes for this event to appear in CloudTrail. From here, inspect the CloudTrail log and see that the UserAgent field is populated, as well as the source IP address.

Next, run the following command:

███████ ████████

Wait 5-10 minutes for this event to appear in CloudTrail. From here, inspect the CloudTrail log and see that the UserAgent field and network information is "AWS Internal". Because of this endpoint we used, we cannot see the request information which may degrade a defenders ability to track down an adversary.

List of endpoints exhibiting this behavior

• ████

Please note: We follow an industry standard 90-day vulnerability disclosure policy. You can read more about our policy here.

Impact

Summary:

An adversary can use these endpoints to avoid disclosing their source IP address or user agent information to the victim.