⬇ Download holy card: ·
Blessed whoAMI, Who Swapped Images
Patron of cloud images picked by name, Terraform scripts that trust the most recent one, and impostors on display in the marketplace.
Life
On 12 February 2025 Seth Art of Datadog Security Labs described whoAMI, a name-confusion attack on AWS machine images. Anyone who looked up an AMI by name alone, taking the most recent and naming no owner, could end up launching a stranger's public image with the same name. The trick even worked on some internal, non-production AWS systems, which AWS fixed within days.
Prayer
O Blessed whoAMI, who answered to any name, teach us always to ask who signed the image before we boot it. Amen.
How to celebrate
Celebrated by always naming the owner in AMI lookups and turning on AWS Allowed AMIs, which shuts the door on strangers.
Pick your image by its name, and the impostor is yours to claim.