SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Amazon Bedrock's ServiceNow connector may bypass document access restrictions

0
·1 views

A pilot implementation of Amazon Bedrock's ServiceNow connector revealed potential security implications. The documentation instructs administrators to assign roles that bypass per-knowledge-base user criteria restrictions. During testing on September 4, 2026, a service account configured exactly as documented successfully retrieved documents restricted to specific user groups. This allowed an internal IT assistant to return sensitive information to unauthorized users during a staging environment test. The configuration followed AWS guidelines precisely, highlighting the described system behavior.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Amazon ECS introduces non-critical daemons, allowing failure without instance replacement.

Amazon ECS introduced a 'non-critical' setting for its Managed Daemons feature on September 3, 2026. This new parameter allows operators to designate agents, like metrics exporters, as non-critical. If a non-critical daemon fails, the host EC2 instance will not be automatically drained and replaced, unlike with critical daemons like security agents. The change addresses prior rigid coupling, offering more flexibility in cluster management. However, the core startup guarantee, ensuring daemons run before application tasks, remains intact for both types.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Study finds legacy network monitoring platforms often exposed with security risks

A study using ZoomEye data from September 2026 identified thousands of exposed instances of monitoring platforms Cacti and LibreNMS. These systems accumulate over time, often managed by departed engineers and excluded from asset inventories. They typically store credentials granting broad access to the devices they monitor, creating significant security risks. Cacti specifically has a history of vulnerabilities exploitable by authenticated users. Security recommendations include restricting interfaces to management networks, auditing credentials, and maintaining regular patch cycles.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Dev platform launches 27 free, client-side web calculators for developers

The DEV Community has released a suite of 27 free web-based calculators designed for developers and founders. These tools require no user authentication, accounts, or payments to operate. All calculations are performed client-side in JavaScript and WebAssembly, ensuring no user data is sent to remote servers. The utilities are hosted on Cloudflare's edge network for global speed and cover topics from AI model sizing to tax and database cost estimations. This initiative addresses concerns over ad-ridden, data-collecting calculators commonly found online.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AWS EC2 to let AMI owners specify compatible instance types starting September 2026

Starting September 4, 2026, Amazon EC2 will allow AMI owners to explicitly declare supported or unsupported instance types. This new InstanceTypeSpecification feature will block incompatible launches at the RunInstances API call. The change aims to prevent launch failures where instances boot but later crash due to hardware or software incompatibility. It centralizes compatibility enforcement at the AMI level, eliminating the need for duplicate IAM or SCP rules across accounts. The feature will be available at no extra cost across all AWS regions.

0 comments Read more at DEV Community