AWS Load Balancer Controller can be used by an attacker to modify rules of any Security Group that they are able to tag

Summary: The IAM Policy of AWS Load Balancer Controller allows it to modify rules of any SG on the AWS Account. This is legitimately used to manage Security Groups created by the controller when an Ingress resource doesn’t explicit a SG. Annotations can be added to the Ingress to change inbound …

VPC_ID=vpc-00123456789abcdef
CLUSTER_NAME=kind

# Developer legitimatly creates a security group to protect some service
UNMANAGED_SG_ID=$(aws ec2 create-security-group --description unmanaged-sg --group-name unmanaged-sg --vpc-id ${VPC_ID} | jq -r .GroupId)

# Attacker tags the unmanaged security …