AWS DevOps Agent Security Tested: Guardrails Hold, But Permissive Roles Pose Risks

A security researcher tested AWS DevOps Agent's directed actions feature by granting an elevated role broad permissions and attempting unauthorized operations on EC2 instances. Tests showed that a permissive SSM document combined with a broadly privileged elevated role allowed installation of an arbitrary software package after explicit approval. However, the agent blocked operations like ec2:RunInstances that fall outside its supported action set, even when those permissions were attached to the elevated role. The researcher emphasized that CloudTrail logging is critical for detecting misuse, since the agent's approval step does not itself act as a guardrail when the attacker controls the approval. Risks extend beyond malicious actors, as mistaken approvals or social engineering could also lead to unintended changes.