Configured Is Not Enforced

This piece is my read on research published by TrustOnCloud. The findings are theirs; the argument about what they mean is mine. Their original write-up is worth reading in full.

Tell me – do you actually trust the permissions you define in the cloud?

Because something has just come to light that should jolt anyone sleeping soundly on the strength of least privilege. A research company called TrustOnCloud discovered that AWS simply did not enforce permission conditions that AWS itself had marketed.

What happened

November 2025: Amazon releases four new condition keys for DynamoDB. The purpose is to give you fine-grained control over who can access which records in a Global Secondary Index. You write a nice policy, restrict every user to their own data only, and hit deploy. You feel responsible. You feel secure.

Just one small problem. Amazon was not evaluating those conditions at runtime at all.

Which means a player authorised to access only their own profile could quietly pull the profiles of every other player. No error. No block. No sign at all that anything was wrong. Your policy was there, it looked excellent in the code, and it did nothing.

As if that were not enough, the official documentation even claimed you could substitute these keys for a different authorisation mechanism. Incorrect information, in official documentation, about a security feature.

Now stop and think how much of your security is built on assumption

You assumed the condition was enforced. You assumed the documentation was accurate. You assumed that if you did not get an Access Denied, everything was working properly.

This is exactly what I have been preaching to our pentesters for years. Configured is not enforced. A permission you have not tested by hand – with an allow scenario and a deny scenario – is wishful thinking.

We see it at clients every week. A magnificent security stack, complex IAM policies, gorgeous architecture documents. And then we actually try to reach something we are not allowed to reach, and it simply works.

The lesson is not “Amazon messed up”

Technology giants make mistakes, it happens, and here at least it was addressed. The lesson is that you cannot delegate your trust to a vendor and then go to sleep peacefully.

Security is not what is written in the policy. Security is what happens when somebody actually tries to break in.

When did you last check that your permissions are genuinely enforced, rather than merely defined?

I first shared a version of this as a LinkedIn post on 2026-07-21. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula