A Kinesis library fix leaves a credential question behind

AWS says versions of its Java Kinesis Producer Library before 1.0.8 can write resolved AWS credentials to the Daemon's debug log. A separate path passes credentials to a native child process as command-line arguments, where a local user may be able to read them. This is a client library running in customer applications, not a claim that the managed Kinesis service was breached.

The affected packages are com.amazonaws:amazon-kinesis-producer through 0.15.12 and software.amazon.kinesis:amazon-kinesis-producer before 1.0.8. AWS says upgrading to 1.0.8 or later is the complete fix. It has not claimed active exploitation in the bulletin.

1. 1

   Find affected producers. Search deployed Java applications and dependency records for both package coordinates. Verify the library actually running, including older 0.x deployments.

2. 2

   Upgrade and verify. Move to version 1.0.8 or later and confirm the deployed application has picked it up. If an immediate upgrade is impossible, follow AWS's Daemon logging guidance and restrict local access while planning the fix.

3. 3

   Assess credentials already exposed. Review who could read process arguments or old logs. Restrict or redact affected logs, rotate long-lived IAM keys and revoke role sessions where the exposure warrants it.

Close this with two records: the version now running and the decision about credentials that may already have been visible. That second decision depends on the logging configuration, access to the host and logs, and the lifetime and permissions of the credentials.