AWS Security Digest

Monday,
October 28, 2024

🥖 Palette Cleanser

What is the state of cloud security? Datadog is very glad you asked! Their answer comes complete with pretty moving birds in the header, adding credibility to the data. There's lots of great fodder to copy and paste to your manager in order to convince them of whatever you want. For example, 46% of you savages are still using IAM users, so it must be totes fine to continue. The report includes a technical description of how they got the data at the end, which is a nice touch for the nerds (me).

A lot of awesome protective resources were published this week that deserve their own mention. Travis McPeak from Resourcely teamed up with a bunch of cloud veterans to gift us a huge repository of cloud guardrails. CloudCopilot explained every IAM condition operator in excruciating detail. And we got introductions to two tools: SkyScalpel for combatting IAM obfuscation, and CloudTail for long-term log retention and search.

I somehow missed the SANS CloudSecNext Summit 2024, oops! Luckily, the presentations are up on YouTube.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

AWS CDK Risk: Exploiting a Missing S3 Bucket Allowed Account Takeover by Ofek Itach & Yakir Kadkoda

This is the purest form of AWS hacking, like Milo straight out of the tin. 1. Find an AWS account that has evidence of CDK use. 2. Create an S3 bucket with a predictable name. 3. Do whatever you like because CDK trusts the CloudFormation in the bucket. AWS has patched CDK to make this impossible, assuming everyone updates their CDK. Do you patch your CDK?
Protecting Data and Preventing Ransomware: The IAM Guide to Managing and Updating Encryption for AWS Resources by Jason Kao

I'm worried about Jason's health. He is clearly obsessed with KMS and his friends are planning an intervention. This is the latest in a series of KMS security posts. Most cloud ransomware requires the ability to modify existing encryption keys. This post covers the IAM actions needed for ransomware, findings on IAM inconsistencies and practical strategies for defending against cloud ransomware.
What I’ve Learned: My Top AWS WAF Tips for Stronger Protection by Sena Yakut

If you're like me, you've probably deployed the AWS WAF in front of something (like an API) and then more or less left it to run on its own. Sena rightly points out that there's more to a successful deployment than just deployment. Sena writes awesome technical content but this post is more about what to do and less about how to do it.

🥖 Palette Cleanser

📋 Chef's selections

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🤖 Dessert

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS Security Bulletins