AWS Security Digest

Monday,
September 23, 2024

🥖 Palette Cleanser

This issue is a real treat, like Milo ice cream covered in... Milo. There were two big events in AWS security this week:

fwd:cloudsec Europe - My apologies for not making a fuss about it in issues prior. It was the first iteration outside the U.S. of A. From what I've been told it turned out better than anyone could have hoped, with top tier talks running all day. Even better still, the entire stream is available for anyone to watch AND Christophe Tafani-Dereeper of Datadog has very kindly produced our first guest video summarising his highlights of the con. Rumour has it the next issue might include another guest video. 🤫
AWS launched their Vulnerability Disclosure Program (VDP) on Hackerone (pronounced like Macaroni). I could get snarky here because it's been a loooooooong time coming but I won't because we made it, and this is damn cool. Nick Frichette posted a good summary thread on Twitter.
In a spectacularly timed coincidence, Ryan Nolette (Senior Security Engineer, AWS Security Outreach) took us behind the scenes of the VDP and the AWS remedation process in his fwd:cloudsec presentation. Having interacted with Ryan a bunch, I can confidently say that he is a star that AWS needs to take care of like an 800 year old Bonsai Tree. His slide deck includes a reference to an "invite-only AWS Private Bug Bounty Program". 😲🤭

Oh, and here's the much requested AWS Security Digest RSS feed. Sorry it took so long.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

undocumented-aws-api-hunter by Nick Frichette

The observant clicker of links might notice that this is not an article. It is in fact an open source tool released as part of Nick's fwd:cloudsec talk, Hidden Among the Clouds: A Look at Undocumented AWS APIs. Why link to the tool instead? Because I've been trying to bribe, coerce, convince, and extort this tool out of Nick for years without success. Undocumented APIs have been a great source of gold for Nick's research and provide unexpected insights into production services and data. Maybe an inspired engineer could turn the tool into a public service?
A Cloud Access Management Maturity Model: Part 1 & Part 2 by Rowan Udell

Rowan suggests that there are 4 phases to cloud access: Administrator-centric, Role-Based Access Control (RBAC), Just-in-Time (JIT), and finally Adaptive. He describes the challenges with each approach, what it looks like and how to progress to the next. It's clearly a plug for the Common Fate solution but it also reads pretty true to me.
Highlights from fwd:cloudsec Europe 2024 by Christophe Tafani-Dereeper

This is the much more detailed text version of Christophe's summary video. Even if you like the video format better, all the links (and there are a lot) are in the blog post.

Bonus: A trio of resources from the AWS mothership...

Dessert is made by robots, for those that enjoy the industrial content.