Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

Secret echoed to public build log → cloud takeover

A workflow accidentally runs `env` or `set -x` during debugging — the AWS access key is now in public CI logs and indexed by Google Cache / GitHub search.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: open-source repo with CI logs left public. At least one PR or merge introduced a debug step that dumped environment variables.

§ Steps

  1. 01
    Authenticate to cloudInitial Access
    T1078— Valid Accounts
  2. 02
    Enumerate IAM / projectDiscovery
    T1087— Account Discovery
  3. 03
    Search public CI logs for AWS_/AZURE_/GCP_ patternsReconnaissance
    W-RECON-GITHUB-DORK— GitHub / GitLab Dorking
  4. 04
    Mass data exfilCollection
    C-S3-EXFIL— S3 / Blob / GCS Mass Exfil
  5. 05
    Privilege escalation (PassRole / SA impersonation)Privilege Escalation
    C-AWS-IAM-PASSROLE— AWS iam:PassRole Chain
  6. 06
    Identify leaked credentialCredential Access
    CI-SECRET-IN-LOG— Secret Echo to Build Log

§ References

§ Frequently asked

What is the "Secret echoed to public build log → cloud takeover" attack path?
A workflow accidentally runs `env` or `set -x` during debugging — the AWS access key is now in public CI logs and indexed by Google Cache / GitHub search. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Authenticate to cloud (T1078) — a initial access primitive. Assumed environment: open-source repo with CI logs left public.
What is the final impact of this kill-chain?
The final step lands on Identify leaked credential (CI-SECRET-IN-LOG), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers