Lex NevaJan 09
9
Monday January, 2023
Sponsor
New Year, same AWS IAM headache? 😣
What if you could find and fix your critical IAM issues in less than 30 days?
What if it was also free and easy for your whole team to use?
k9 Security’s Starter Plan is available at no cost for ASD subscribers all month!
In a nutshell
Today marks a significant occasion for ASD with the release of the 100th issue of the newsletter.
The newsletter started as a personal collection of AWS security news but has now grown to have over 1500 subscribers following updates on a weekly basis. Additionally, the newsletter has secured recurring sponsorships from partners.
We are incredibly grateful for the support and readership of the newsletter so far. If you have enjoyed reading the newsletter, please consider spreading the word to others who may also be interested.
Your support helps us to continue bringing you the latest updates on AWS security.
📢 MAMIP (Monitor AWS Managed IAM Policies)
Policies changed since last week:
- AWSConfigServiceRolePolicy
- AWSElasticDisasterRecoveryStagingAccountPolicy_v2
- AWSOutpostsAuthorizeServerPolicy
- AWSSSMForSAPServiceLinkedRolePolicy
- AWS_ConfigRole
- AmazonECS_FullAccess
- CloudwatchApplicationInsightsServiceLinkedRolePolicy
- ResourceGroupsServiceRolePolicy
- ViewOnlyAccess
SRE Weekly Issue #354
[tl;dr sec] #163 - Rebuilding Detection and IR at LinkedIn, CVEs and Misaligned Incentives
Clint at tl;dr secJan 05
AWS Audit Manager - 2 updated methods
Jan 6
This release introduces a new data retention option in your Audit Manager settings. You can now use the DeregistrationPolicy parameter to specify if you want to delete your data when you deregister Audit Manager.
AmplifyBackend - 1 updated methods
Jan 5
Updated GetBackendAPIModels response to include ModelIntrospectionSchema json string
AWS App Runner - 6 updated methods
Jan 5
This release adds support of securely referencing secrets and configuration data that are stored in Secrets Manager and SSM Parameter Store by adding them as environment secrets in your App Runner service.
Amazon Connect Service - 2 updated methods
Jan 5
Documentation update for a new Initiation Method value in DescribeContact API
How to query and visualize Macie sensitive data discovery results with Athena and QuickSight
Keith RozarioJan 6
Amazon Macie is a fully managed data security service that uses machine learning and pattern matching to help you discover and protect sensitive data in Amazon Simple Storage Service (Amazon S3). With Macie, you can analyze objects in your S3 buckets to detect occurrences of sensitive data, such as personally identifiable information (PII), financial information, personal …
Updated whitepaper available: AWS Security Incident Response Guide
Anna McAbeeJan 4
The AWS Security Incident Response Guide focuses on the fundamentals of responding to security incidents within a customer’s Amazon Web Services (AWS) Cloud environment. You can use the guide to help build and iterate on your AWS security incident response program. Recently, we updated the AWS Security Incident Response Guide …
ec2: 29 updated actions, 7 updated conditions
Jan 7
29 updated actions: AuthorizeSecurityGroupEgress (resources), AuthorizeSecurityGroupIngress (resources), DescribeClientVpnAuthorizationRules (resources), DescribeClientVpnConnections (resources), DescribeClientVpnRoutes (resources), DescribeClientVpnTargetNetworks (resources), DescribeFleetHistory (resources), DescribeFleetInstances (resources), DescribeImageAttribute (resources), DescribeInstanceAttribute (resources), DescribeSnapshotAttribute (resources), DescribeSpotFleetInstances (resources), DescribeSpotFleetRequestHistory (resources), DescribeVolumeAttribute (resources), DisableAddressTransfer (resources), DisableFastLaunch (resources), EnableAddressTransfer (resources), EnableFastLaunch (resources), GetCoipPoolUsage (resources), GetConsoleScreenshot (resources), GetVpnConnectionDeviceSampleConfiguration (resources), ModifyInstanceCapacityReservationAttributes (resources), ModifySecurityGroupRules (resources), MoveByoipCidrToIpam …
iotroborunner: 29 removed actions, 5 removed resources, 5 removed conditions
Jan 6
29 removed actions: CreateAction (Grants permission to create an action), CreateActionTemplate (Grants permission to create an action template), CreateActionTemplateDependency (Grants permission to create an action template dependency), CreateActivity (Grants permission to create an activity), CreateActivityDependency (Grants permission to create an activity dependency), CreateDestinationRelationship (Grants permission to create a destination relationship), …
Amazon S3 Encrypts New Objects By Default | Amazon Web Services
At AWS, security is the top priority. Starting today, Amazon Simple Storage Service (Amazon S3) encrypts all new objects by default. Now, S3 automatically applies …
Scott Piper S3 at rest encryption by default and soon it'll be non-trivial to make an S3 bucket public because Public Block access will be applied by default in …
Aidan W Steele If S3 is going to encrypt all objects by default, what are we going to argue about now? (Welcome move, one less dimension for customers to misconfigu…
I scanned every package on PyPi and found 57 live AWS keys
After inadvertently finding that InfoSys leaked an AWS key on PyPi I wanted to know how many other live AWS keys may be present on …
Why Not Mars
It’s slow, expensive, the engineering is mostly port-a-potty chemistry, and the best-case outcome is that thirty years from now we’ll get to watch someone remotely …
Update detected · z0ph/MAMIP@067b455
[MAMIP] Monitor AWS Managed IAM Policies Changes . Contribute to z0ph/MAMIP development by creating an account on GitHub.
Nick Frichette - @frichetten@fosstodon.org @Frichette_n
*screaming in cloud security* tomforb.es/i-scanned-ever…
124
28Jan 07 · 2:55 AM Scott Piper @0xdabbad00
S3 at rest encryption by default and soon it'll be non-trivial to make an S3 bucket public because Public Block access will be applied by default in April. We also got multiple MFAs for the root and the root email no longer tied to the underpants account. Thank you AWS folks!
AWS Blog Unofficial. @AWSBlogUnreal
The AWS News Blog #AWSNews
aws.amazon.com/blogs/aws/amaz…
By: Sébastien Stormacq
10120Jan 05 · 11:39 PM Aidan W Steele @__steele
If S3 is going to encrypt all objects by default, what are we going to argue about now? (Welcome move, one less dimension for customers to misconfigure)
aws.amazon.com/blogs/aws/amaz…
11010Jan 05 · 10:54 PM
Clint Gibler @clintgibler
☁️ Cloud penetration testing: Not your typical internal penetration test
@sethsec walks through how doing an internal (assume breach) cloud pen test is different than a typical pen test, with examples of increasingly useful things to look for
sethsec.blogspot.com/2022/12/cloud-…
8524Jan 06 · 5:00 PM Nick Frichette - @frichetten@fosstodon.org @Frichette_n
How about another real world attacker critique thread? @ExpelSecurity just published a great piece on an intrusion they took care of (Great work team). A thread. 🧵 expel.com/blog/incident-…
8124Jan 07 · 2:33 AM
Abby Fuller @abbyfuller
another year and still no fucking idea how to use mastodon
874Jan 03 · 2:23 AM Aidan W Steele @__steele
Devs: make it your new years resolution to serve OPTIONS at the edge. Your users in Australia and India will thank you.
(It's very painful to use a modern SPA webapp and have dozens of round-trips each take an extra 250ms just for the preflights)
aws.amazon.com/blogs/networki…
7810Jan 06 · 1:29 AM
Ben Kehoe @ben11kehoe
It's a small thing but the SEC opting not to refer to Elon Musk, even obliquely, as a founder of Tesla is hilarious (from @matt_levine's always excellent Money Stuff)
682Jan 06 · 9:36 PM Clint Gibler @clintgibler
😈 Attacker persistence in #Kubernetes using the TokenRequest API
The TokenRequest API can be used to create long-lived and hard-to-detect privileged access
@raesene on how attackers can abuse it & how to detect misuse by monitoring k8s audit logs
securitylabs.datadoghq.com/articles/kuber…
3813Jan 06 · 9:00 PM
Matt Fuller @matthewdfuller
AWS Lambda function URLs + CloudFront is a pretty great combination. I've got a custom domain, TLS-enabled, WAF-protected, nearly-infinitely-scalable endpoint for like... $0.05/month.
490Jan 02 · 9:40 PM
AWS IP Ranges update for 2022-12-27 23:43:05
Changed by -16
Removed 3.33.49.240/30
Removed 52.46.189.36/30
Removed 52.46.189.40/30
Removed 52.46.191.108/30
Removed 3.33.49.240/30
Removed 52.46.189.36/30
Removed 52.46.189.40/30
Removed 52.46.191.108/30
AWS IP Ranges update for 2022-12-28 00:23:06
Changed by -32
Removed 3.33.49.136/29
Removed 3.33.49.192/29
Removed 3.33.49.132/30
Removed 3.33.49.144/30
Removed 3.33.49.164/30
Removed 3.33.49.180/30
Removed 3.33.49.136/29
Removed 3.33.49.192/29
Removed 3.33.49.132/30
Removed 3.33.49.144/30
Removed 3.33.49.164/30
Removed 3.33.49.180/30
- 🖊️ This digest was forwarded to you? Subscribe here
- 📢 Promote your content with sponsorship
- 💌 Want to suggest new content: contact me or reply to this email
