Amazon Cognito
Merchant sign-in, tokens, MFA and session-risk signals
AWS service architecture + incident path
See what runs where—and why
The service map names the AWS building blocks and their purpose. The attack-path map below shows how the compromised merchant session moves across those boundaries.
Architecture at a glance
AWS services in use
AWS managed service labels distinguish cloud services from Roaming Bites application components and external providers.
User boundary
Merchant browser
Campaign prompts, assets and account session
AWS ACCOUNT · ROAMING BITES PRODUCTION
AWS managed service
→
Roaming Bites component
→
Roaming Bites component
→
AWS managed service
AWS managed service
Roaming Bites component
AWS managed service
AWS managed service
AWS CloudTrailAWS API calls such as
Amazon CloudWatch LogsApplication and instrumented runtime events
Route 53 Resolver logsDNS queries and DNS Firewall decisions
VPC Flow LogsAccepted and rejected network-flow metadata
Amazon GuardDutyMalicious-domain and runtime findings
Campaign Assistant API
Campaign requests, tenant checks and context assembly
Agent orchestrator
Tool policy, job state and ECS task creation
Amazon ECS on EC2
Five-minute tool workspace running the campaign job
Supporting servicesThese enable or authorize the core path; they are not another sequence.
AWS IAM
Orchestrator, task, execution and EC2 node roles
Authorizes AWS actionsConnector broker
Keeps provider tokens away from the workspace
Uses the merchant's Google grantAmazon Bedrock
LLM inference requested by the application
Called by the orchestratorAmazon S3
Approved tenant-scoped campaign artifacts
Read and written by scoped rolesSecurity telemetryThese services observe different parts of the path; none contains the whole story.
RunTask
External services
Google DriveOAuth storage, public sharing and submission retrieval
GitHub RawPublic file delivery
Callback domainsAttacker-controlled HTTPS
LocalTunnelPublic relay to the workspace
Scope of this map: the evidence identifies the Campaign Assistant as an application and shows the AWS services it calls, but it never identifies how its web tier or business database are hosted. Those parts are therefore shown as logical Roaming Bites components rather than being labelled as API Gateway, Lambda, CloudFront, DynamoDB or another guessed implementation. This does not mean a web host or database is absent—only that participants do not need an invented service choice to investigate this incident.
Interactive incident path
Follow the compromise across trust boundaries
Choose a phase, then select a node to inspect its runtime, service identity, permissions and evidence. The architecture above highlights the same phase.
Valid account access
A stolen password creates a valid merchant session and reaches the normal campaign workspace.