AWS Updates Threat Technique Catalog for June 2026, Enhancing Cloud Security Guidance

The AWS Customer Incident Response Team (CIRT) has rolled out its latest update to the Threat Technique Catalog for AWS (TTC) for June 2026, a resource designed to help customers understand and mitigate common security threats in their AWS environments. The catalog's entries are directly informed by patterns observed by the AWS CIRT during incident response engagements, ensuring that the guidance is relevant and actionable. This update specifically addresses three key areas: container security, organization-level trust, and compute hijacking. For container security, the catalog highlights techniques threat actors use to exploit Amazon Elastic Kubernetes Service (Amazon EKS) workloads. This includes modifying running workloads by altering container images, injecting sidecar containers, or changing pod specifications to introduce malicious code. The update emphasizes that these changes often go unnoticed without proper admission controllers or image verification. Recommended mitigations include enforcing image signing through admission controllers, restricting workload changes with Kubernetes role-based access control (RBAC), and enabling Amazon GuardDuty EKS Protection to detect anomalous cluster activity. Regarding organization-level trust, the catalog details how threat actors can exploit organizational structures. This involves inviting accounts to unknown organizations, which can allow the attacker's organization to apply Service Control Policies (SCPs) that restrict legitimate owners, gain visibility into account resources, and access consolidated billing information. This can effectively lock legitimate owners out of their own governance controls. Important preventive measures include monitoring `organizations:InviteAccountToOrganization` and `organizations:AcceptHandshake` API calls, and implementing SCPs that prevent accounts from leaving their legitimate organization. Finally, the update covers compute hijacking, particularly within Amazon Elastic Container Service (Amazon ECS). This involves methods threat actors use to deploy unauthorized tasks in ECS, often by abusing overly permissive task execution roles. The catalog also refreshes existing entries, such as "S3 Object Collection," to capture additional API calls used for bulk data staging from Amazon S3, providing refined detection guidance and mitigations that leverage recent Amazon S3 security features. The AWS CIRT's commitment is to make this information accessible, empowering organizations to enhance their security posture and resilience against disruption. Each entry in the TTC provides straightforward mitigation advice, helping security and platform teams proactively defend against sophisticated attack techniques.