The whoAMI attack is possible due to misconfigured AMI selection in AWS environments: The retrieval of AMIs by software using the ec2:DescribeImages API without specifying an owner The use of ...