Nick Frichette
@frichetten.com
Staff Security Researcher @datadoghq | DEF CON/Black Hat USA main stage speaker | he/him | OSCP OSWE | I turned hacking AWS into a career | Tweets are my own | Created https://hackingthe.cloud
Very cool research on a CodeBuild misconfiguration which could have had significant consequences. I’m a bit disappointed that there wasn’t more done to secure the supply chain after the Q Developer incident.
www.wiz.io/blog/wiz-res...
www.wiz.io/blog/wiz-res...
CodeBreach: Supply Chain Vuln & AWS CodeBuild Misconfig | Wiz Blog
Wiz Research discovered CodeBreach, a critical vulnerability that risked the AWS Console supply chain. Learn how to secure your AWS CodeBuild pipelines.
www.wiz.io
January 15, 2026 at 6:46 PM
Very cool research on a CodeBuild misconfiguration which could have had significant consequences. I’m a bit disappointed that there wasn’t more done to secure the supply chain after the Q Developer incident.
www.wiz.io/blog/wiz-res...
www.wiz.io/blog/wiz-res...
We’re hiring! Join the Datadog Security Research team as a Senior Security Researcher specializing in GenAI and help shape the future of AI security!
careers.datadoghq.com/detail/75146...
careers.datadoghq.com/detail/75146...
Senior Security Researcher - GenAI | Datadog Careers
We're building a platform that engineers love to use. Join us, and help usher in the future.
careers.datadoghq.com
January 14, 2026 at 3:29 PM
We’re hiring! Join the Datadog Security Research team as a Senior Security Researcher specializing in GenAI and help shape the future of AI security!
careers.datadoghq.com/detail/75146...
careers.datadoghq.com/detail/75146...
Fiber internet is breaking my brain. Streaming 4K video from my home server to my phone over the internet. It doesn’t even stutter. Insane.
January 12, 2026 at 8:01 PM
Fiber internet is breaking my brain. Streaming 4K video from my home server to my phone over the internet. It doesn’t even stutter. Insane.
The 2025 Hacking the Cloud: Year in Review is out! We take a look at the growing tide of software supply chain attacks, discuss the most critical cloud vuln discovered to date, and share some stats for the site!
hackingthe.cloud/blog/2025_wr...
hackingthe.cloud/blog/2025_wr...
2025 Hacking the Cloud: Year in Review - Hacking The Cloud
An end of year summary for Hacking the Cloud in 2025.
hackingthe.cloud
January 5, 2026 at 3:17 PM
The 2025 Hacking the Cloud: Year in Review is out! We take a look at the growing tide of software supply chain attacks, discuss the most critical cloud vuln discovered to date, and share some stats for the site!
hackingthe.cloud/blog/2025_wr...
hackingthe.cloud/blog/2025_wr...
New on @hackingthe.cloud, did you know that attackers can prevent you from kicking them out of your environment in certain situations? Eduard Agavriloae shares his research on how attackers can nullify containment attempts!
hackingthe.cloud/aws/post_exp...
hackingthe.cloud/aws/post_exp...
IAM Persistence through Eventual Consistency - Hacking The Cloud
Abuse IAM's eventual consistency to maintain persistence against incident response containment.
hackingthe.cloud
December 18, 2025 at 4:25 PM
New on @hackingthe.cloud, did you know that attackers can prevent you from kicking them out of your environment in certain situations? Eduard Agavriloae shares his research on how attackers can nullify containment attempts!
hackingthe.cloud/aws/post_exp...
hackingthe.cloud/aws/post_exp...
I’m running behind on PRs, DMs, the Hacking the cloud EoY report, etc. I will catch up in time, I’m just trying to rest and heal this horrible fever.
December 16, 2025 at 1:51 PM
I’m running behind on PRs, DMs, the Hacking the cloud EoY report, etc. I will catch up in time, I’m just trying to rest and heal this horrible fever.
Currently backed myself into a corner by ignoring my own advice: When researching vulns in a cloud service, learn how the service works BEFORE you start hunting. Do it in the reverse order and you’ll end up with a vuln you can’t tie to real impact, because you never learned how harm could occur.
December 3, 2025 at 5:04 PM
Currently backed myself into a corner by ignoring my own advice: When researching vulns in a cloud service, learn how the service works BEFORE you start hunting. Do it in the reverse order and you’ll end up with a vuln you can’t tie to real impact, because you never learned how harm could occur.
If you’re messing with the AWS console in Burp Suite and getting some weird errors when trying to HEAD S3 buckets, go into your proxy listener settings and turn OFF HTTP/2 support. I was baffled for a bit trying to get a service to work and that solved it.
November 24, 2025 at 8:12 PM
If you’re messing with the AWS console in Burp Suite and getting some weird errors when trying to HEAD S3 buckets, go into your proxy listener settings and turn OFF HTTP/2 support. I was baffled for a bit trying to get a service to work and that solved it.
Ah yes, the alloy known as '<span class="no-text-formatting">white gold</span>'
October 2, 2025 at 9:33 PM
Ah yes, the alloy known as '<span class="no-text-formatting">white gold</span>'
Today in weird things family members say about technology, this is “the weird internet frisbee”.
October 1, 2025 at 9:26 PM
Today in weird things family members say about technology, this is “the weird internet frisbee”.
New on @hackingthe.cloud! A great post by Federico Lucini on bypassing AWS Network Firewall egress filtering!
hackingthe.cloud/aws/post_exp...
hackingthe.cloud/aws/post_exp...
AWS Network Firewall Egress Filtering Bypass - Hacking The Cloud
Bypass AWS Network Firewall Egress Filtering using SNI spoofing and Host Header manipulation.
hackingthe.cloud
September 29, 2025 at 2:30 PM
New on @hackingthe.cloud! A great post by Federico Lucini on bypassing AWS Network Firewall egress filtering!
hackingthe.cloud/aws/post_exp...
hackingthe.cloud/aws/post_exp...
Are you interested in pushing the boundaries of Gen AI security? Do you want to join an accomplished team of researchers, software engineers, and hackers? Join us!
careers.datadoghq.com/detail/71207...
careers.datadoghq.com/detail/71207...
Senior Security Researcher - GenAI | Datadog Careers
We're building a platform that engineers love to use. Join us, and help usher in the future.
careers.datadoghq.com
September 23, 2025 at 6:44 PM
Are you interested in pushing the boundaries of Gen AI security? Do you want to join an accomplished team of researchers, software engineers, and hackers? Join us!
careers.datadoghq.com/detail/71207...
careers.datadoghq.com/detail/71207...
Shout out to @flekyy90.bsky.social for not one, but two new articles on Hacking the Cloud! If you're interesting in learning more persistence methods definitely check them out!
hackingthe.cloud/aws/post_exp...
hackingthe.cloud/aws/post_exp...
AWS CodeBuild GitHub Runner Persistence - Hacking The Cloud
Abusing the CodeBuild managed GitHub Actions runner integration to obtain long‑term access to an AWS environment.
hackingthe.cloud
September 22, 2025 at 2:00 PM
Shout out to @flekyy90.bsky.social for not one, but two new articles on Hacking the Cloud! If you're interesting in learning more persistence methods definitely check them out!
hackingthe.cloud/aws/post_exp...
hackingthe.cloud/aws/post_exp...
Added a new challenge coin to the display today, in recognition of my contributions to the AWS Vulnerability Disclosure Program. I’m excited to continue pushing the boundaries of AWS security and helping to build a more secure cloud!
September 18, 2025 at 7:04 PM
Added a new challenge coin to the display today, in recognition of my contributions to the AWS Vulnerability Disclosure Program. I’m excited to continue pushing the boundaries of AWS security and helping to build a more secure cloud!
@fwdcloudsec.org Europe 2025 was incredible! Amazing talks, amazing research, and amazing people. There is no other conference I would recommend for cloud security people. Looking forward to next year!
September 17, 2025 at 11:44 PM
@fwdcloudsec.org Europe 2025 was incredible! Amazing talks, amazing research, and amazing people. There is no other conference I would recommend for cloud security people. Looking forward to next year!
Good morning @fwdcloudsec.org! If you would like exclusive, limited edition, holographic stickers, come find me!
September 15, 2025 at 7:03 AM
Good morning @fwdcloudsec.org! If you would like exclusive, limited edition, holographic stickers, come find me!
Looking forward to seeing everyone in Berlin! Safe travels! @fwdcloudsec.org
September 13, 2025 at 1:06 PM
Looking forward to seeing everyone in Berlin! Safe travels! @fwdcloudsec.org
While not explicitly stated, I do want to stress: Cloud security people aggressively preach not storing long lived AWS access keys in CI/CD pipelines, and that you should instead use things like OIDC. However, that isn’t a silver bullet. In addition…
September 7, 2025 at 5:11 PM
While not explicitly stated, I do want to stress: Cloud security people aggressively preach not storing long lived AWS access keys in CI/CD pipelines, and that you should instead use things like OIDC. However, that isn’t a silver bullet. In addition…
Reposted by Nick Frichette
Thanks to folks including @frichetten.com for feedback about our Bedrock API key launch. We're listening. Yesterday, we updated Bedrock and IAM docs (see docs.aws.amazon.com/bedrock/late...) to clarify that these are service-specific credentials and how to prevent their use in your environment. 1/2
September 6, 2025 at 12:39 AM
Thanks to folks including @frichetten.com for feedback about our Bedrock API key launch. We're listening. Yesterday, we updated Bedrock and IAM docs (see docs.aws.amazon.com/bedrock/late...) to clarify that these are service-specific credentials and how to prevent their use in your environment. 1/2
For any security research leaders attending @fwdcloudsec.org EU, DM me. I’d love to meet with you and chat about your organizational structure! Who do you report to, how do you divide your teams, what are your success criteria, etc.
September 2, 2025 at 4:15 PM
For any security research leaders attending @fwdcloudsec.org EU, DM me. I’d love to meet with you and chat about your organizational structure! Who do you report to, how do you divide your teams, what are your success criteria, etc.
AWS’s commitment to this host name template is incredible. It’s everywhere!
August 29, 2025 at 1:34 PM
AWS’s commitment to this host name template is incredible. It’s everywhere!
Major shout out to @andoniaf.unicrons.cloud for adding three new privilege escalation techniques to the Hacking the Cloud catalog! Contributions like this make everything possible.
hackingthe.cloud/aws/exploita...
hackingthe.cloud/aws/exploita...
AWS IAM Privilege Escalation Techniques - Hacking The Cloud
Common techniques that can be leveraged to escalate privileges in an AWS account.
hackingthe.cloud
August 21, 2025 at 3:24 PM
Major shout out to @andoniaf.unicrons.cloud for adding three new privilege escalation techniques to the Hacking the Cloud catalog! Contributions like this make everything possible.
hackingthe.cloud/aws/exploita...
hackingthe.cloud/aws/exploita...
If you’re thinking of buying a house, please get two inspections. Or budget 2-5% for repairs that the inspectors miss. Or just don’t buy a house T_T
August 20, 2025 at 5:53 PM
If you’re thinking of buying a house, please get two inspections. Or budget 2-5% for repairs that the inspectors miss. Or just don’t buy a house T_T
Reposted by Nick Frichette
Enumerating AWS the quiet way: CloudTrail-free discovery with Resource Explorer
by @frichetten.com
securitylabs.datadoghq.com/articles/enu...
by @frichetten.com
securitylabs.datadoghq.com/articles/enu...
Enumerating AWS the quiet way: CloudTrail-free discovery with Resource Explorer | Datadog Security Labs
Discover how attackers could quietly enumerate AWS resources via Resource Explorer, and how Datadog and AWS worked together to close the visibility gap.
securitylabs.datadoghq.com
August 20, 2025 at 7:33 AM
Enumerating AWS the quiet way: CloudTrail-free discovery with Resource Explorer
by @frichetten.com
securitylabs.datadoghq.com/articles/enu...
by @frichetten.com
securitylabs.datadoghq.com/articles/enu...
Meet my enemy of the day. A piece of metal (razor blade) in my tire.
August 19, 2025 at 8:53 PM
Meet my enemy of the day. A piece of metal (razor blade) in my tire.