Token Leakage in Dynamodb

Token leakage in DynamoDB contexts occurs when temporary credentials, API keys, or authentication tokens are exposed through DynamoDB operations, logging, or error responses. This manifests in several DynamoDB-specific patterns that developers often overlook.

The most common scenario involves DynamoDB API responses that include temporary credentials. When using DynamoDB's GetSessionToken or similar operations, responses contain SecretAccessKey, SessionToken, and Expiration fields. If these responses are logged, returned in error messages, or included in API responses without proper sanitization, attackers can extract valid credentials.

Another DynamoDB-specific pattern occurs with IAM role assumptions. When applications assume IAM roles to access DynamoDB tables, the temporary credentials are valid for a limited time. If these credentials are exposed through DynamoDB operations like Scan, Query, or BatchGetItem, attackers can use them before expiration to access other AWS resources.

Token leakage also appears in DynamoDB's pagination mechanisms. When using LastEvaluatedKey for pagination, applications sometimes inadvertently include sensitive metadata or credentials in the pagination state. This becomes critical when pagination state is stored in client-side storage or transmitted between services.

Consider this vulnerable DynamoDB pattern: