Link to the room: https://tryhackme.com/room/hh-complimentary-05e0b604

Day 3 challenge of Hacker Holidays focused on a common cloud security issue: an AWS Cognito Identity Pool misconfiguration.

Understanding how an unauthenticated AWS Cognito Identity Pool can expose sensitive DynamoDB data.

Room: Complimentary — TryHackMe Cloud Hacker Holidays: Day 3

A wellness app was quietly handing out AWS credentials to every visitor. We used them to dump the entire database. Here is how.

In some enterprise environments, machine identities outnumber people by more than 100 to 1 — and excessive access remains widespread.

In case you didn’t know, the Hacker Holidays event by TryHackMe is currently underway. The room for the event’s third day covers common…

A walk-through of TryHackMe’s Hacker Holiday 2026 challenge covering AWS misconfigurations, Cognito identity pools, and IAM security risks.

Introduction