Exploring the new AWS Sign Up experience
Wiz analyzed AWS's new sandboxed sign-up experience, finding it omits CloudTrail, blocks security services, and limits vendor IAM role access.
AWS's new sign-up experience creates three accounts in an Organization sandbox governed by SCPs and RCPs, with a $20/month budget that triggers a spend-limit SCP denying new compute workloads. Wiz found the sandbox lacks organization-level CloudTrail and its FreeTierSCP allowlist denies GuardDuty, Security Hub, Detective, Inspector, Macie, and Access Analyzer, while still permitting IAM users with access keys, public S3 buckets, and IMDSv1 EC2 instances. A remaining RCP blocks all principals outside the Organization, denying cross-account sts:AssumeRole and preventing vendor IAM role integrations until the account is upgraded. Wiz concludes the sandbox prioritizes simplicity and cost control over a strong security posture.
- New AWS sign-up creates a three-account Organization sandbox without organization-level CloudTrail
- FreeTierSCP allowlist blocks GuardDuty, Security Hub, Inspector, Macie, and Access Analyzer
- RCP denies cross-account sts:AssumeRole, complicating vendor IAM role integrations
- Sandbox still permits IAM access keys, public S3 buckets, and IMDSv1 EC2 instances
- A $20/month budget SCP denies new compute workloads when breached
From the original article
6 min read at wiz.io
This post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox.
By Scott Piper · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.