Using AWS Certificate Manager as a covert exfiltration mechanism

One of my hobbies is researching covert exfiltration mechanisms that use public cloud services 1 . Public cloud at its core has most service endpoints on the internet. If all you need is a bit of compute talking to some storage, you’d rather not involve the internet at all. Enter private endpoints VPC-only access to managed services. On AWS, you can attach policies to some of them, so only your…