IAMTrail - All Changes https://iamtrail.com All IAMTrail changes in one feed - discoveries, IAM policies, endpoints, and GuardDuty announcements. An unofficial archive by zoph.io. en-us Fri, 07 Aug 2026 22:04:32 GMT 60 AWSManagedBudgetsSpendLimitManagementAccess: scope changed, no action added or removed (v2) https://iamtrail.com/policies/AWSManagedBudgetsSpendLimitManagementAccess/ https://github.com/zoph-io/IAMTrail/commit/45fb963e15518645a830a3efef688089e23ea30b Fri, 07 Aug 2026 22:03:45 GMT IAM Policy Scope changed, no action added or removed in AWSManagedBudgetsSpendLimitManagementAccess (v2).

]]> AmazonSageMakerJobRuntimeAccess: 2 actions added (v2) https://iamtrail.com/policies/AmazonSageMakerJobRuntimeAccess/ https://github.com/zoph-io/IAMTrail/commit/a1bfeb652f29a0bf55114b0defacee6a061079c7 Fri, 07 Aug 2026 19:03:19 GMT IAM Policy kms Actions added: kms:Decrypt, kms:GenerateDataKey

]]> CloudWatchAutomaticDashboardsAccess: 2 actions added (v5) https://iamtrail.com/policies/CloudWatchAutomaticDashboardsAccess/ https://github.com/zoph-io/IAMTrail/commit/07450004696414b7959af28cb6c66c768741b661 Fri, 07 Aug 2026 11:03:54 GMT IAM Policy lambda Actions added: lambda:GetFunctionConfiguration, lambda:ListTags

]]> New policy: AmazonODBNetworkAdmin (24 actions) https://iamtrail.com/policies/AmazonODBNetworkAdmin/ https://github.com/zoph-io/IAMTrail/commit/e76778f36a1ea4b02a0e2fbb593921f89b03da0f Fri, 07 Aug 2026 02:03:32 GMT IAM Policy ec2 iam odb Permissions management: ec2:CreateOdbNetworkPeering, ec2:DeleteOdbNetworkPeering, ec2:ModifyOdbNetworkPeering, iam:CreateServiceLinkedRole

Actions added: ec2:CreateOdbNetworkPeering, ec2:DeleteOdbNetworkPeering, ec2:DescribeAvailabilityZones, ec2:DescribeVpcs, ec2:ModifyOdbNetworkPeering, iam:CreateServiceLinkedRole, odb:CreateOdbNetwork, odb:CreateOdbPeeringConnection and 16 more

]]> New policy: AmazonODBReadOnlyAccess (32 actions) https://iamtrail.com/policies/AmazonODBReadOnlyAccess/ https://github.com/zoph-io/IAMTrail/commit/a3c5672055f6b7b7caa8799d9e4e9d59adc40209 Fri, 07 Aug 2026 02:03:32 GMT IAM Policy ec2 odb Actions added: ec2:DescribeAvailabilityZones, ec2:DescribeVpcs, odb:GetAutonomousDatabase, odb:GetAutonomousDatabaseBackup, odb:GetCloudAutonomousVmCluster, odb:GetCloudExadataInfrastructure, odb:GetCloudExadataInfrastructureUnallocatedResources, odb:GetCloudVmCluster and 24 more

]]> New policy: AmazonODBAutonomousVmClusterAdmin (21 actions) https://iamtrail.com/policies/AmazonODBAutonomousVmClusterAdmin/ https://github.com/zoph-io/IAMTrail/commit/6720f5e3c4074c4fda4034a735b31c129d4ac2f4 Fri, 07 Aug 2026 02:03:31 GMT IAM Policy ec2 odb Actions added: ec2:DescribeAvailabilityZones, odb:CreateCloudAutonomousVmCluster, odb:CreateOutboundIntegration, odb:DeleteCloudAutonomousVmCluster, odb:GetCloudAutonomousVmCluster, odb:GetCloudExadataInfrastructure, odb:GetCloudExadataInfrastructureUnallocatedResources, odb:GetOciOnboardingStatus and 13 more

]]> New policy: AmazonODBExadataInfrastructureAdmin (21 actions) https://iamtrail.com/policies/AmazonODBExadataInfrastructureAdmin/ https://github.com/zoph-io/IAMTrail/commit/086246263af4a31242bb266b94c366f433a1efb6 Fri, 07 Aug 2026 02:03:31 GMT IAM Policy ec2 iam odb Permissions management: iam:CreateServiceLinkedRole

Actions added: ec2:DescribeAvailabilityZones, iam:CreateServiceLinkedRole, odb:CreateCloudExadataInfrastructure, odb:DeleteCloudExadataInfrastructure, odb:DeleteResourcePolicy, odb:GetCloudExadataInfrastructure, odb:GetCloudExadataInfrastructureUnallocatedResources, odb:GetDbServer and 13 more

]]> AWSManagedSettingsAdminAccess: scope changed, no action added or removed (v3) https://iamtrail.com/policies/AWSManagedSettingsAdminAccess/ https://github.com/zoph-io/IAMTrail/commit/2567942b9554ae0e684bcbc08933473fbb086210 Fri, 07 Aug 2026 01:03:38 GMT IAM Policy Scope changed, no action added or removed in AWSManagedSettingsAdminAccess (v3).

]]> Endpoint changes: 1 service expansion https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/01ee98096bef1201cfe10e7b72c920fa0ce63b1e Fri, 07 Aug 2026 00:07:48 GMT Endpoints aws 1 service expansion in the AWS endpoint data.

  • cassandra expanded to ca-west-1 [aws]
]]> AgentRegistryFullAccess: 3 never-before-seen actions https://iamtrail.com/policies/AgentRegistryFullAccess/ https://github.com/zoph-io/IAMTrail/commit/e9769e1a9b0155ce1a97a1af7cd6095f488ec719 Thu, 06 Aug 2026 19:03:26 GMT IAM Policy bedrock-agentcore iam kms secretsmanager 3 never-before-seen actions: bedrock-agentcore:CreateWorkloadIdentity, bedrock-agentcore:DeleteWorkloadIdentity, bedrock-agentcore:GetResourceOauth2Token

Permissions management: iam:CreateServiceLinkedRole, iam:PassRole

Actions added: bedrock-agentcore:CreateWorkloadIdentity, bedrock-agentcore:DeleteWorkloadIdentity, bedrock-agentcore:GetResourceOauth2Token, bedrock-agentcore:GetWorkloadAccessToken, bedrock-agentcore:GetWorkloadIdentity, bedrock-agentcore:ListOauth2CredentialProviders, iam:CreateServiceLinkedRole, iam:ListRoles and 3 more

]]> AgentRegistryReadOnlyAccess: new AWS service agent-registry https://iamtrail.com/policies/AgentRegistryReadOnlyAccess/ https://github.com/zoph-io/IAMTrail/commit/4f5b0e06bbacc7e96407116b758c6d4e3b7a6807 Thu, 06 Aug 2026 19:03:26 GMT IAM Policy agent-registry New AWS service agent-registry: agent-registry. Never seen in any AWS managed policy before.

Actions added: agent-registry:GetDiscoverableRegistryRecord, agent-registry:GetRegistry, agent-registry:GetRegistryRecord, agent-registry:InvokeRegistryMcp, agent-registry:ListDiscoverableRegistryRecords, agent-registry:ListRegistries, agent-registry:ListRegistryRecords, agent-registry:ListTagsForResource and 1 more

]]> AWSBackupAccessPointOperatorAccess: 6 never-before-seen actions https://iamtrail.com/policies/AWSBackupAccessPointOperatorAccess/ https://github.com/zoph-io/IAMTrail/commit/a4c4b788b632301a2cd93ec6a2de9e8a1fb9800c Thu, 06 Aug 2026 17:03:13 GMT IAM Policy backup kms s3 6 never-before-seen actions: backup:ListBackupAccessPoints, backup:ListBackupAccessPointsByRecoveryPoint, backup:ListBackupAccessPointsByResource, s3:CreateAccessPoint, s3:DeleteAccessPoint, s3:PutAccessPointPolicy

Permissions management: s3:PutAccessPointPolicy

Actions added: backup:CreateBackupAccessPoint, backup:DeleteBackupAccessPoint, backup:DescribeBackupAccessPoint, backup:ListBackupAccessPoints, backup:ListBackupAccessPointsByRecoveryPoint, backup:ListBackupAccessPointsByResource, kms:Decrypt, s3:CreateAccessPoint and 3 more

]]> AWSTransformNetworkMigrationAgentPolicy: 25 never-before-seen actions https://iamtrail.com/policies/AWSTransformNetworkMigrationAgentPolicy/ https://github.com/zoph-io/IAMTrail/commit/9efdcaf98e810ba450213b0eb68f88411e7ad881 Thu, 06 Aug 2026 16:04:22 GMT IAM Policy cloudformation directconnect ec2 elasticloadbalancing globalaccelerator iam kms lambda logs mgn 25 never-before-seen actions: mgn:CreateNetworkMigrationDefinition, mgn:DeleteNetworkMigrationDefinition, mgn:GetNetworkMigrationDefinition, mgn:ListNetworkMigrationAnalyses, mgn:ListNetworkMigrationAnalysisResults, mgn:ListNetworkMigrationCodeGenerationSegments, mgn:ListNetworkMigrationCodeGenerations, mgn:ListNetworkMigrationDefinitions and 17 more

Permissions management: iam:AttachRolePolicy, iam:CreateRole, iam:CreateServiceLinkedRole, iam:DeleteRole, iam:DeleteRolePolicy, iam:DetachRolePolicy, iam:PassRole, ram:AssociateResourceShare and 6 more

Actions added: cloudformation:CreateStack, cloudformation:DeleteStack, cloudformation:DescribeStackEvents, cloudformation:DescribeStackResources, cloudformation:DescribeStacks, cloudformation:GetTemplateSummary, cloudformation:ListStackResources, cloudformation:ListStacks and 213 more

]]> AWSTransformServerMigrationAgentPolicy: 30 never-before-seen actions https://iamtrail.com/policies/AWSTransformServerMigrationAgentPolicy/ https://github.com/zoph-io/IAMTrail/commit/ceedd66de8d6094b9707b9e5dacaa4ab89f4ccee Thu, 06 Aug 2026 16:04:22 GMT IAM Policy ec2 fsx iam kms mgn organizations s3 secretsmanager servicequotas ssm 30 never-before-seen actions: mgn:AssociateApplications, mgn:AssociateSourceServers, mgn:CreateApplication, mgn:CreateWave, mgn:DeleteApplication, mgn:DeleteWave, mgn:DisassociateApplications, mgn:DisassociateSourceServers and 22 more

Permissions management: iam:PassRole

Actions added: ec2:AttachVolume, ec2:AuthorizeSecurityGroupEgress, ec2:CreateLaunchTemplateVersion, ec2:CreateSecurityGroup, ec2:CreateSnapshot, ec2:CreateTags, ec2:CreateVolume, ec2:DeleteLaunchTemplateVersions and 117 more

]]> AWSTransformLandingZoneAgentPolicy: 5 never-before-seen actions https://iamtrail.com/policies/AWSTransformLandingZoneAgentPolicy/ https://github.com/zoph-io/IAMTrail/commit/f3d85ddc72017e84b39d2de4bb8b88a35ff22116 Thu, 06 Aug 2026 16:04:21 GMT IAM Policy cloudformation controltower organizations s3 servicecatalog 5 never-before-seen actions: controltower:EnableBaseline, controltower:EnableControl, controltower:GetBaseline, controltower:TagResource, organizations:CreateOrganizationalUnit

Actions added: cloudformation:CreateChangeSet, cloudformation:CreateStack, cloudformation:DescribeChangeSet, cloudformation:DescribeStackEvents, cloudformation:DescribeStacks, cloudformation:ExecuteChangeSet, cloudformation:GetTemplate, cloudformation:ListChangeSets and 53 more

]]> New policy: AWSAgentRegistryServiceRolePolicy (1 action) https://iamtrail.com/policies/AWSAgentRegistryServiceRolePolicy/ https://github.com/zoph-io/IAMTrail/commit/e5d232872ad2eb59814468de52e86a24ac3fe12e Thu, 06 Aug 2026 15:03:39 GMT IAM Policy cloudwatch Actions added: cloudwatch:PutMetricData

]]> BedrockAgentCoreRuntimeInstancesOperatorRolePolicy: scope changed, no action added or removed (v2) https://iamtrail.com/policies/BedrockAgentCoreRuntimeInstancesOperatorRolePolicy/ https://github.com/zoph-io/IAMTrail/commit/4369cdc422a80519ad664e3bb4371c4b9860164f Thu, 06 Aug 2026 11:03:34 GMT IAM Policy Scope changed, no action added or removed in BedrockAgentCoreRuntimeInstancesOperatorRolePolicy (v2).

]]> 3 never-before-seen actions on Amazon S3 (s3) https://iamtrail.com/discoveries/ iamtrail:discovery:actions:2026-08-06:s3 Thu, 06 Aug 2026 00:00:00 GMT Discovery Never-before-seen action s3 3 never-before-seen actions on Amazon S3 (s3), first seen in AWSBackupAccessPointOperatorAccess.

Permissions management: s3:PutAccessPointPolicy

s3:CreateAccessPoint, s3:DeleteAccessPoint, s3:PutAccessPointPolicy

]]> 1 never-before-seen action: organizations:CreateOrganizationalUnit https://iamtrail.com/actions/b3JnYW5pemF0aW9uczpDcmVhdGVPcmdhbml6YXRpb25hbFVuaXQ/ iamtrail:discovery:actions:2026-08-06:organizations Thu, 06 Aug 2026 00:00:00 GMT Discovery Never-before-seen action organizations 1 never-before-seen action on AWS Organizations (organizations), first seen in AWSTransformLandingZoneAgentPolicy.

organizations:CreateOrganizationalUnit

]]> 55 never-before-seen actions on AWS Application Migration Service (mgn) https://iamtrail.com/discoveries/ iamtrail:discovery:actions:2026-08-06:mgn Thu, 06 Aug 2026 00:00:00 GMT Discovery Never-before-seen action mgn 55 never-before-seen actions on AWS Application Migration Service (mgn), first seen in AWSTransformServerMigrationAgentPolicy, AWSTransformNetworkMigrationAgentPolicy.

mgn:AssociateApplications, mgn:AssociateSourceServers, mgn:CreateApplication, mgn:CreateNetworkMigrationDefinition, mgn:CreateWave, mgn:DeleteApplication, mgn:DeleteNetworkMigrationDefinition, mgn:DeleteWave and 47 more

]]> 4 never-before-seen actions on AWS Control Tower (controltower) https://iamtrail.com/discoveries/ iamtrail:discovery:actions:2026-08-06:controltower Thu, 06 Aug 2026 00:00:00 GMT Discovery Never-before-seen action controltower 4 never-before-seen actions on AWS Control Tower (controltower), first seen in AWSTransformLandingZoneAgentPolicy.

controltower:EnableBaseline, controltower:EnableControl, controltower:GetBaseline, controltower:TagResource

]]> 3 never-before-seen actions on Amazon Bedrock Agentcore (bedrock-agentcore) https://iamtrail.com/discoveries/ iamtrail:discovery:actions:2026-08-06:bedrock-agentcore Thu, 06 Aug 2026 00:00:00 GMT Discovery Never-before-seen action bedrock-agentcore 3 never-before-seen actions on Amazon Bedrock Agentcore (bedrock-agentcore), first seen in AgentRegistryFullAccess.

bedrock-agentcore:CreateWorkloadIdentity, bedrock-agentcore:DeleteWorkloadIdentity, bedrock-agentcore:GetResourceOauth2Token

]]> 3 never-before-seen actions on AWS Backup (backup) https://iamtrail.com/discoveries/ iamtrail:discovery:actions:2026-08-06:backup Thu, 06 Aug 2026 00:00:00 GMT Discovery Never-before-seen action backup 3 never-before-seen actions on AWS Backup (backup), first seen in AWSBackupAccessPointOperatorAccess.

backup:ListBackupAccessPoints, backup:ListBackupAccessPointsByRecoveryPoint, backup:ListBackupAccessPointsByResource

]]> New AWS service agent-registry https://iamtrail.com/discoveries/ iamtrail:discovery:service:agent-registry Thu, 06 Aug 2026 00:00:00 GMT Discovery New AWS service agent-registry agent-registry appeared in an AWS managed IAM policy for the first time, in AgentRegistryReadOnlyAccess.

9 actions on this prefix are now tracked.

]]> AWSIAMRoleManagerServiceRolePolicy: 1 action added (v2). Permissions management: iam:CreateServiceLinkedRole https://iamtrail.com/policies/AWSIAMRoleManagerServiceRolePolicy/ https://github.com/zoph-io/IAMTrail/commit/956bf538f03dcaced1ac4dea864bc0ce6a5536d9 Wed, 05 Aug 2026 20:03:25 GMT IAM Policy iam Permissions management: iam:CreateServiceLinkedRole

Actions added: iam:CreateServiceLinkedRole

]]> BatchServiceRolePolicy: 4 never-before-seen actions https://iamtrail.com/policies/BatchServiceRolePolicy/ https://github.com/zoph-io/IAMTrail/commit/5a3ee017141b8dcaa5842035ea331a248929f901 Wed, 05 Aug 2026 18:03:38 GMT IAM Policy ecs 4 never-before-seen actions: ecs:CreateCapacityProvider, ecs:DeleteCapacityProvider, ecs:PutClusterCapacityProviders, ecs:UpdateCapacityProvider

Actions added: ecs:CreateCapacityProvider, ecs:DeleteCapacityProvider, ecs:DescribeCapacityProviders, ecs:PutClusterCapacityProviders, ecs:UntagResource, ecs:UpdateCapacityProvider, ecs:UpdateCluster

]]> New policy: AIDevOpsConstellationAccessPolicy (11 actions) https://iamtrail.com/policies/AIDevOpsConstellationAccessPolicy/ https://github.com/zoph-io/IAMTrail/commit/c97f656d548fdcbe80a997e07ff25c74d4246e16 Wed, 05 Aug 2026 17:03:23 GMT IAM Policy aidevops Actions added: aidevops:CreateBacklogTask, aidevops:GetAgentSpace, aidevops:GetAsset, aidevops:GetAssetContent, aidevops:GetAssetFile, aidevops:GetBacklogTask, aidevops:ListAssetFiles, aidevops:ListAssets and 3 more

]]> BedrockAgentCoreRuntimeInstancesInstanceRolePolicy: 1 never-before-seen action https://iamtrail.com/policies/BedrockAgentCoreRuntimeInstancesInstanceRolePolicy/ https://github.com/zoph-io/IAMTrail/commit/993af0cf6aa5aabf112ae7409f6a05872e60a63a Wed, 05 Aug 2026 14:03:50 GMT IAM Policy bedrock-agentcore 1 never-before-seen action: bedrock-agentcore:PutSystemLogEvents

Actions added: bedrock-agentcore:PutSystemLogEvents

]]> BedrockAgentCoreRuntimeInstancesOperatorRolePolicy: 1 never-before-seen action https://iamtrail.com/policies/BedrockAgentCoreRuntimeInstancesOperatorRolePolicy/ https://github.com/zoph-io/IAMTrail/commit/3989ecd1eae49ef31aaa59b77256df331bcde25d Wed, 05 Aug 2026 12:03:38 GMT IAM Policy autoscaling ec2 events iam 1 never-before-seen action: autoscaling:LaunchInstances

Permissions management: iam:CreateServiceLinkedRole, iam:PassRole

Actions added: autoscaling:CompleteLifecycleAction, autoscaling:CreateAutoScalingGroup, autoscaling:DescribeAutoScalingGroups, autoscaling:DescribeAutoScalingInstances, autoscaling:LaunchInstances, autoscaling:PutLifecycleHook, autoscaling:UpdateAutoScalingGroup, ec2:AttachNetworkInterface and 26 more

]]> New policy: AWSBedrockAgentCoreRuntimeInstancesServiceRolePolicy (16 actions) https://iamtrail.com/policies/AWSBedrockAgentCoreRuntimeInstancesServiceRolePolicy/ https://github.com/zoph-io/IAMTrail/commit/1af1cfbba1fdef5cf0e68d5bd5d4f15a553e08bd Wed, 05 Aug 2026 10:03:45 GMT IAM Policy autoscaling ec2 events Actions added: autoscaling:CompleteLifecycleAction, autoscaling:DeleteAutoScalingGroup, autoscaling:DescribeAutoScalingGroups, ec2:DeleteLaunchTemplate, ec2:DeleteLaunchTemplateVersions, ec2:DeleteVolume, ec2:DescribeInstanceStatus, ec2:DescribeInstances and 8 more

]]> 4 never-before-seen actions on Amazon Elastic Container Service (ecs) https://iamtrail.com/discoveries/ iamtrail:discovery:actions:2026-08-05:ecs Wed, 05 Aug 2026 00:00:00 GMT Discovery Never-before-seen action ecs 4 never-before-seen actions on Amazon Elastic Container Service (ecs), first seen in BatchServiceRolePolicy.

ecs:CreateCapacityProvider, ecs:DeleteCapacityProvider, ecs:PutClusterCapacityProviders, ecs:UpdateCapacityProvider

]]> Endpoint changes: 1 service expansion https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/93d5c8eae611ab4015cfda40e8603ea55d06dbe2 Fri, 31 Jul 2026 09:10:49 GMT Endpoints aws 1 service expansion in the AWS endpoint data.

  • vpc-lattice expanded to ap-southeast-5 [aws]
]]> Endpoint changes: 1 new service https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/19725482fcb759e090f2c7763770d062364cfcfc Wed, 29 Jul 2026 19:26:25 GMT Endpoints aws-iso aws-iso-b 1 new service in the AWS endpoint data.

  • emr-serverless (1 endpoint) [aws-iso]
  • emr-serverless (1 endpoint) [aws-iso-b]
]]> Endpoint changes: 1 new service https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/107fce163ec6a5232f2c37c2aae7dcb2bf01715e Mon, 27 Jul 2026 19:44:08 GMT Endpoints aws-iso 1 new service in the AWS endpoint data.

  • appstream2 (2 endpoints) [aws-iso]
]]> Endpoint changes: 3 new services https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/10c539e0d89099fe7cb16e779fc25ef86c452a92 Fri, 24 Jul 2026 19:38:44 GMT Endpoints aws-iso aws-iso-b aws-iso-e 3 new services in the AWS endpoint data.

  • compute-optimizer (1 endpoint) [aws-iso]
  • cost-optimization-hub (1 endpoint) [aws-iso]
  • compute-optimizer (1 endpoint) [aws-iso-b]
  • cost-optimization-hub (1 endpoint) [aws-iso-b]
  • rolesanywhere (1 endpoint) [aws-iso-e]
]]> Endpoint changes: 1 new service, 2 service expansions https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/770567f78fceecb4e20d777d1de8a0b4913d2316 Wed, 22 Jul 2026 19:35:47 GMT Endpoints aws aws-eusc 1 new service, 2 service expansions in the AWS endpoint data.

  • drs expanded to ap-east-2, ap-southeast-5, ap-southeast-7, mx-central-1 [aws]
  • omics expanded to ap-northeast-1, us-east-2 [aws]
  • redshift-serverless (1 endpoint) [aws-eusc]
]]> Endpoint changes: 1 new service, 2 service expansions https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/dad7113e65e5062b5787511255bf3bb2b16df019 Sat, 18 Jul 2026 03:11:18 GMT Endpoints aws-eusc aws-iso aws-iso-b 1 new service, 2 service expansions in the AWS endpoint data.

  • guardduty expanded to us-iso-west-1 [aws-iso]
  • backup expanded to us-isob-west-1 [aws-iso-b]
  • emr-serverless (1 endpoint) [aws-eusc]
]]> GuardDuty New Finding: UnauthorizedAccess:IAMUser/ResourceCredentialExfiltration.InsideAWS https://iamtrail.com/guardduty/ iamtrail:guardduty:2026-07-17T14:49:35Z:NEW_FINDINGS:unauthorizedaccess-iamuser-resourcecredentialexfiltration-insideaws Fri, 17 Jul 2026 14:49:35 GMT GuardDuty New Finding This finding informs you that a host within AWS has attempted to run AWS API operations using temporary AWS credentials that were created on an ECS resource in your AWS environment.

]]> GuardDuty New Finding: UnauthorizedAccess:IAMUser/ResourceCredentialExfiltration.OutsideAWS https://iamtrail.com/guardduty/ iamtrail:guardduty:2026-07-17T14:49:35Z:NEW_FINDINGS:unauthorizedaccess-iamuser-resourcecredentialexfiltration-outsideaws Fri, 17 Jul 2026 14:49:35 GMT GuardDuty New Finding This finding informs you that a host outside of AWS has attempted to run AWS API operations using temporary AWS credentials that were created on an ECS resource in your AWS environment.

]]> Endpoint changes: 1 service expansion https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/31af253ee49bea34214380b92e7d0152d5f69fa4 Fri, 17 Jul 2026 03:21:31 GMT Endpoints aws-iso-b 1 service expansion in the AWS endpoint data.

  • storagegateway expanded to us-isob-west-1 [aws-iso-b]
]]> GuardDuty New Feature: Amazon GuardDuty now offers AI Protection, expanding threat detection to AWS AI services including Amazon Bedrock and... https://iamtrail.com/guardduty/ iamtrail:guardduty:2026-07-14T20:37:24Z:NEW_FEATURES:amazon-guardduty-now-offers-ai-protection-expanding-threat-detection-to-aws-ai-s Tue, 14 Jul 2026 20:37:24 GMT GuardDuty New Feature Amazon GuardDuty now offers AI Protection, expanding threat detection to AWS AI services including Amazon Bedrock and Amazon SageMaker. As organizations rapidly adopt AI, security teams may lack visibility into threats specifically targeting AI workloads, such as anomalous model invocations, cost harvesting attacks, and prompt injection attempts. GuardDuty AI Protection continuously monitors these workloads so security teams can detect and respond to AI-specific threats without manual configuration or custom tooling. GuardDuty AI Protection analyzes both CloudTrail management and data events from AWS AI services to identify suspicious activity, including unusual invocation patterns, cost harvesting attacks where threat actors force AI resources to consume excessive GPU time and tokens, and prompt injection attempts through integration with Amazon Bedrock Guardrails. AI Protection introduces three new finding types: Impact:IAMUser/AnomalousModelInvocation, Impact:IAMUser/CostHarvesting, and Impact:IAMUser/PromptInjection.Direct. GuardDuty AI Protection can be enabled with a few steps in the GuardDuty or Security Hub console, and using AWS Organizations, can be centrally enabled for all accounts in an organization.

]]> Endpoint changes: 1 service expansion https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/e8a69b4d1a7500ed3d8b623939ad8f7fb7bd9b92 Mon, 13 Jul 2026 19:38:10 GMT Endpoints aws 1 service expansion in the AWS endpoint data.

  • wisdom expanded to af-south-1 [aws]
]]> Endpoint changes: 1 service expansion https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/601925e542e1cd3fcf2a861cbc0d1c0dbfacd92e Fri, 10 Jul 2026 19:42:33 GMT Endpoints aws 1 service expansion in the AWS endpoint data.

  • aps expanded to ap-southeast-6 [aws]
]]> Endpoint changes: 1 new service https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/7cf1bc425813bb6af501b9d80a23790ee8265e57 Mon, 06 Jul 2026 20:06:44 GMT Endpoints aws-iso-e aws-iso-f 1 new service in the AWS endpoint data.

  • health (1 endpoint) [aws-iso-e]
  • health (1 endpoint) [aws-iso-f]
]]> Endpoint changes: 1 service expansion https://iamtrail.com/endpoints/ https://github.com/boto/botocore/commit/420c5848eac57be3c4dcc5c9b1f36085de397695 Fri, 03 Jul 2026 03:53:26 GMT Endpoints aws 1 service expansion in the AWS endpoint data.

  • codepipeline expanded to ap-southeast-6 [aws]
]]> GuardDuty New Feature: Amazon GuardDuty now offers AI-powered investigations in public preview, a new capability that automatically analyzes... https://iamtrail.com/guardduty/ iamtrail:guardduty:2026-06-22T23:38:51Z:NEW_FEATURES:amazon-guardduty-now-offers-ai-powered-investigations-in-public-preview-a-new-ca Mon, 22 Jun 2026 23:38:51 GMT GuardDuty New Feature Amazon GuardDuty now offers AI-powered investigations in public preview, a new capability that automatically analyzes GuardDuty findings and accounts to help you quickly distinguish true threats from benign findings. Each investigation delivers a structured summary in minutes with confidence-scored disposition, MITRE ATT&CK technique classification, and actionable recommendations. You can initiate investigations from the GuardDuty console, CLI, API, or AWS MCP Server. This feature is available in 10 AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Stockholm), and Asia Pacific (Tokyo). To learn more, visit the Amazon GuardDuty User Guide.

]]> GuardDuty New Feature: Amazon GuardDuty has increased the Malware Protection for S3 archive extraction quotas. The maximum number of files... https://iamtrail.com/guardduty/ iamtrail:guardduty:2026-06-09T22:59:33Z:NEW_FEATURES:amazon-guardduty-has-increased-the-malware-protection-for-s3-archive-extraction- Tue, 09 Jun 2026 22:59:33 GMT GuardDuty New Feature Amazon GuardDuty has increased the Malware Protection for S3 archive extraction quotas. The maximum number of files that can be extracted and analyzed from an archive has increased from 10,000 to 100,000, and the maximum archive depth levels have increased from 5 to 100.

]]> GuardDuty Updated Finding: Persistence:Kubernetes/ContainerWithSensitiveMount https://iamtrail.com/guardduty/ iamtrail:guardduty:2026-05-30T05:10:55Z:UPDATED_FINDINGS:persistence-kubernetes-containerwithsensitivemount Sat, 30 May 2026 05:10:55 GMT GuardDuty Updated Finding This finding type is replaced by Persistence:Kubernetes/AnomalousBehavior.WorkloadDeployed!ContainerWithSensitiveMount, which provides enhanced detection coverage using anomaly-based machine learning.

]]> GuardDuty Updated Finding: PrivilegeEscalation:Kubernetes/PrivilegedContainer https://iamtrail.com/guardduty/ iamtrail:guardduty:2026-05-30T05:10:55Z:UPDATED_FINDINGS:privilegeescalation-kubernetes-privilegedcontainer Sat, 30 May 2026 05:10:55 GMT GuardDuty Updated Finding This finding type is replaced by PrivilegeEscalation:Kubernetes/AnomalousBehavior.WorkloadDeployed!PrivilegedContainer, which provides enhanced detection coverage using anomaly-based machine learning.

]]> GuardDuty New Feature: Amazon GuardDuty Malware Protection for AWS Backup now supports malware scanning for S3 continuous backups, also known... https://iamtrail.com/guardduty/ iamtrail:guardduty:2026-05-27T00:04:06Z:NEW_FEATURES:amazon-guardduty-malware-protection-for-aws-backup-now-supports-malware-scanning Wed, 27 May 2026 00:04:06 GMT GuardDuty New Feature Amazon GuardDuty Malware Protection for AWS Backup now supports malware scanning for S3 continuous backups, also known as point-in-time recovery (PITR). You can now scan S3 continuous backup recovery points for malware, enabling you to confidently restore S3 data to any second within your retention period knowing the recovery point is clean. You can enable this capability even if GuardDuty foundational data sources are not enabled in your account.

]]>