Attackers target the config file first to confirm they can read files from the system. If they can read config , they can likely read credentials . If those keys belong to a highly privileged user or the root account, the attacker can gain full control over the entire AWS environment. How the Attack Works