Lex NevaJan 16
16
Monday January, 2023
Sponsor
unusd.cloud helps you reduce your environmental impact 🍃 by identifying and shutting down mistakenly active assets, lowering your security risks 🔒, and decreasing your AWS bills 🗒️.
Don’t let unused assets drain your AWS budget.
It's free (forever) for a single AWS Account.
In a nutshell
From last week: AWS just made security a top priority by default. S3 now automatically encrypts all new objects with SSE-S3. This change puts another security best practice into effect automatically, with no impact on performance & no action required on your side. Existing buckets using S3 default encryption will not change.
📢 MAMIP (Monitor AWS Managed IAM Policies)
Policies changed since last week:
- AWSCleanRoomsFullAccess
- AWSCleanRoomsFullAccessNoQuerying
- AWSCleanRoomsReadOnlyAccess
- AWSHealth_EventProcessorServiceRolePolicy
- AWSServiceCatalogAdminFullAccess
- AWSSupportServiceRolePolicy
- AmazonLaunchWizard_Fullaccess
- AmazonSageMakerNotebooksServiceRolePolicy
- ReadOnlyAccess
SRE Weekly Issue #355
[tl;dr sec] #164 - Becoming Phishless, Machine Learning
Clint at tl;dr secJan 12
AWS Lambda - 5 updated methods
Jan 12
Add support for MaximumConcurrency parameter for SQS event source. Customers can now limit the maximum concurrent invocations for their SQS Event Source Mapping.
AWS Elemental MediaConvert - 11 updated methods
Jan 12
The AWS Elemental MediaConvert SDK has added support for compact DASH manifest generation, audio normalization using TruePeak measurements, and the ability to clip the sample range in the color corrector.
AWSKendraFrontendService - 1 updated methods
Jan 11
This release adds support to new document types - RTF, XML, XSLT, MS_EXCEL, CSV, JSON, MD
Three key security themes from AWS re:Invent 2022
Anne GrahnJan 13
AWS re:Invent returned to Las Vegas, Nevada, November 28 to December 2, 2022. After a virtual event in 2020 and a hybrid 2021 edition, spirits were high as over 51,000 in-person attendees returned to network and learn about the latest AWS innovations. Now in its 11th year, the conference featured …
Recap to security, identity, and compliance sessions at AWS re:Invent 2022
Katie CollinsJan 13
AWS re:Invent returned to Las Vegas, NV, in November 2022. The conference featured over 2,200 sessions and hands-on labs and more than 51,000 attendees over 5 days. If you weren’t able to join us in person, or just want to revisit some of the security, identity, and compliance announcements and …
elasticmapreduce: 1 new action
Jan 14
1 new action: GetClusterSessionCredentials (Grants permission to retrieve HTTP basic credentials associated with a given execution IAM Role for a fine-grained access control enabled EMR Cluster)
cleanrooms: 34 new actions, 4 new resources
Jan 14
34 new actions: BatchGetSchema (Grants permission to view details for schemas), CreateCollaboration (Grants permission to create a new collaboration, a shared data collaboration environment), CreateConfiguredTable (Grants permission to create a new configured table), CreateConfiguredTableAnalysisRule (Grants permission to create a analysis rule for a configured table), CreateConfiguredTableAssociation (Grants permission to link …
iam: 11 new actions
Jan 14
11 new actions: DeleteCloudFrontPublicKey (Grants permission to delete an existing CloudFront public key), GetAccountEmailAddress (Grants permission to retrieve the email address that is associated with the account), GetAccountName (Grants permission to retrieve the account name that is associated with the account), GetCloudFrontPublicKey (Grants permission to retrieve information about the specified …
Taking The New Secrets Manager Lambda Extension For a Spin
Walkthrough on using the new Lambda Extension to retrieve secrets, and comparison against using Boto3
Matt Fuller IMO this is an area AWS could drastically improve UX. Why are there 5+ different ways to deliver secrets to a function? Env vars. Env vars with a che…
Clint Gibler ☁️ Taking The New Secrets Manager Lambda Extension For a Spin Aquia's Dakota Riley compares the performance of the Secrets Manager Lambda Extension …
Update detected · z0ph/MAMIP@55573d4
[MAMIP] Monitor AWS Managed IAM Policies Changes . Contribute to z0ph/MAMIP development by creating an account on GitHub.
CircleCI incident report for January 4, 2023 security incident
Read the complete incident report from CircleCI’s January 4, 2023 security alert.
Abby Fuller @abbyfuller
the call i'm on just called a floppy disk "the save icon" and i guess i'll go die of old age now
413
30Jan 12 · 4:28 PM Clint Gibler @clintgibler
✅ How to *actually* roll out YubiKeys/WebAuthN
Industry advice is to "just do it"
But it's actually really hard in practice
8 resources on lessons learned from companies who've done it 🧵
26660Jan 11 · 5:00 PM Clint Gibler @clintgibler
🦀 Memory Safe Languages in Android 13
To date, 0 memory safety vulns in Android’s Rust code
Historical vulnerability density is >1/kLOC in C/C++ components → Rust has already prevented 100s of vulns
By @jeffvanderstoep
security.googleblog.com/2022/12/memory…
11727Jan 09 · 5:00 PM
Colm MacCárthaigh @colmmacc
My neighbor works in finance and is required to take a minimum amount of no-contact PTO every year. It ensures there's organizational resilience and it's even seen as a check on fraud. Unlimited PTO would be better with measures like that included ... enforce a minimum.
Christina Warren @film_girl
FTR, unlimited PTO is a scam and we all know it.
1137Jan 12 · 10:37 PM
Ian Mckay @iann0036
If you're interested in permissions management and authorization, check out my new blog post on the new Cedar language - currently integrated into Amazon Verified Permissions and #AWS Verified Access, and more in the future. 🌲🔐
onecloudplease.com/blog/cedar-a-n…
8725Jan 11 · 9:34 AM
rami @ramimacisabird
How many different AWS phishing vectors are you aware of?
I found four - anything I missed?
ramimac.me/aws-phishing
8822Jan 09 · 7:46 PM
Aidan W Steele @__steele
Do you work somewhere that uses Github Enterprise Cloud, but doesn't use GitHub Actions OIDC because it's not possible for AWS org admins to lock down role creation to only your GitHub Enterprise?
I wrote this for you. ✨Fancy✨ screenshot for the tl;dr
awsteele.com/blog/2023/01/1…
5211Jan 11 · 5:34 AM
Pawel Rzepa @Rzepsky
A good example of threat lists in CI/CD: storage.googleapis.com/prd-engineerin…
This 👆 is part of the worth-reading article: engineering.mercari.com/en/blog/entry/… by @MercariDev
3510Jan 10 · 9:42 AM
Steven Bryen @steven_bryen
“Just use Kubernetes” 🙄
Dmitry M @8th_block
@dhh Running your own infra on your own metal has never been easier! Just use Kubernetes. You can find a better open sourced version of practically every AWS product. Even Lambdas
395Jan 13 · 8:47 PM
META: How do we feel about the blog "spam?"
Personally, it drives me up the wall. I feel like 9/10 times a post from /r/aws ends up in my front page, it's just a link to an article with zero comments, no discussion to be had, etc.
I'd feel a lot better about these sorts of posts if the …
AWS IP Ranges update for 2023-01-05 06:03:06
Changed by +2
Added 15.230.19.250/31
Added 15.230.19.250/31
AWS IP Ranges update for 2023-01-05 07:43:09
Changed by -64
Removed 13.34.81.64/26
Removed 13.34.81.64/26
- 🖊️ This digest was forwarded to you? Subscribe here
- 📢 Promote your content with sponsorship
- 💌 Want to suggest new content: contact me or reply to this email
