Abstract: Embodiments detect risky situations in which a domain name record remains viable after the target it identified is not. Such dangling records create various risks because substitute targets, such as fraudulent websites, may be installed without the knowledge of the original target's owner. By obtaining and correlating data from multiple tenants, a cloud service provider detects dangling structures and any attempts to exploit them. Dangling records may specify a custom domain name, for example, or a static IP address that can be misused. In response, the provider's security infrastructure can alert the original target's owner, block the attempted exploit, or otherwise mitigate the risks. Traffic monitoring, control plane API invocations, and domain name server queries may be employed by the security infrastructure to detect resource deletion, resource creation, and resource access attempts that correspond with vulnerable records or suspect activity involving them.

Abstract: Generally discussed herein are devices, systems, and methods for cloud resource security. A method can include receiving, at a monitor device and from a first cloud resource of cloud resources hosted by a cloud provider, a request for a token that uniquely identifies the first cloud resource, the request indicating a destination that is a metadata server. The method can include comparing, based on entries in an application programming interface (API) access log, the cloud provider associated with the first cloud resource and a cloud provider associated with the metadata server. The method can include responsive to the cloud provider of the first cloud resource being different from the cloud provider of the metadata server performing a security mitigation action.

Abstract: Embodiments detect risky situations in which a domain name record remains viable after the target it identified is not. Such dangling records create various risks because substitute targets, such as fraudulent websites, may be installed without the knowledge of the original target's owner. By obtaining and correlating data from multiple tenants, a cloud service provider detects dangling structures and any attempts to exploit them. Dangling records may specify a custom domain name, for example, or a static IP address that can be misused. In response, the provider's security infrastructure can alert the original target's owner, block the attempted exploit, or otherwise mitigate the risks. Traffic monitoring, control plane API invocations, and domain name server queries may be employed by the security infrastructure to detect resource deletion, resource creation, and resource access attempts that correspond with vulnerable records or suspect activity involving them.