Abuse of AWS EC2 Export APIs for Data Exfiltration

Adversaries possessing sufficient IAM permissions within an AWS environment can leverage specific EC2 management APIs to exfiltrate sensitive data. By invoking the CreateInstanceExportTask, ExportImage, or CreateStoreImageTask actions, an attacker can create a copy of an EC2 instance or an Amazon Machine Image (AMI) and export it to an external destination, such as an Amazon S3 bucket. While these operations are standard for legitimate workflows like disaster recovery, cloud migration, or backup processes, they provide a powerful mechanism for unauthorized actors to bypass traditional data egress controls by extracting entire virtual machine disks or system snapshots. Once the data is moved to an S3 bucket or transferred off-account, it becomes significantly harder for organizations to monitor or prevent the exposure of sensitive workloads, including production databases and critical configuration files.

Attack Chain

1. The attacker gains initial access to the AWS environment, often through compromised IAM credentials or a hijacked session.
2. The attacker uses reconnaissance APIs, such as DescribeInstances or DescribeImages, to identify high-value targets containing sensitive data.
3. The attacker confirms that the compromised IAM principal has the necessary permissions (e.g., ec2:CreateInstanceExportTask, ec2:ExportImage) to initiate an export.
4. The attacker executes the chosen export API call (CreateInstanceExportTask, ExportImage, or CreateStoreImageTask) targeting the identified instance or AMI.
5. The AWS EC2 service processes the request, creating a snapshot or export task and moving the data to a specified S3 bucket.
6. The attacker modifies S3 bucket policies or ACLs to allow cross-account access or public reading, if the bucket is under their control.
7. The attacker downloads the exported disk image or system state from the S3 bucket to their local infrastructure to complete the exfiltration.

Impact

Successful exploitation allows for the full exfiltration of virtual machine disk contents, which may include databases, source code, credentials, and sensitive system logs. This can lead to significant data breaches, exposure of intellectual property, and compliance failures. The number of impacted systems is limited only by the permissions of the compromised principal and the inventory of the target AWS account.

Recommendation

1. Deploy the provided detection rule to identify successful EC2 export tasks in CloudTrail logs.
2. Implement strict IAM policies following the principle of least privilege, specifically restricting access to ec2:CreateInstanceExportTask and ec2:ExportImage to only authorized service principals.
3. Enable AWS Config or CloudTrail alerts to monitor for large S3 bucket writes or modification of bucket policies (PutBucketPolicy) related to storage buckets used for export tasks.
4. Audit existing EC2 export workflows to establish a baseline of normal, expected behavior for DevOps and migration teams.