Product
Adversaries can establish persistent access to AWS environments by creating an IAM Roles Anywhere Trust Anchor using an unauthorized external Certificate Authority (CA) to sign forged client certificates.