AWS Security Digest

Monday,
November 04, 2024

🥖 Palette Cleanser

A while back I told you the story of a hardworking gentleman trying to elevate the AWS vulnerability disclosure program. I suggested that AWS should offer him a promotion and pay increase but sadly I don't have that kind of juice with the illuminati. Instead, Ryan Nolette is asking for your help - please complete this survey and share your feedback on the AWS VDP expansion. If you have no idea what I'm talking about, listen to his interview with Corey on Last Week in AWS.

Your AWS Account is a floating cloud of garbage, says Chris Farris. It's a good day when you can insult your readers in the title and still have people read your stuff and think it's cool. There's nothing technical in this article but we would all be well served to heed Chris' pollution metaphor and the insight that, "Pollution is locally caused but globally felt." With that in mind, enjoy this week's garbage you didn't know you had in your AWS account.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

AWS Security Guardrails & Terraform by Naman Sogani

If Naman ever tries to raise VC funding he'll need to work on his marketing. The title buries that lede that the guardrails are AI generated. I don't know how good his tool is in the-real-world but the experiment is a worthy one - use AI to parse standards and tools for security requirements, and automatically build them into infrastructure as code templates.
Breaking free from the chains of fate - Bypassing AWSCompromisedKeyQuarantineV2 Policy by Bleon Proko

So many people have accidentally leaked their AWS access keys on Github that one day the folks at AWS cracked the shits and summoned a magical fairy to protect leaked keys by applying a 'quarantine policy' to them as soon they are leaked. It's an open secret that in the cloud security community that this policy is, let's say, incomplete. So, I'm glad Bleon took the time to publish exactly how it's incomplete and what folks should be aware of. It's worth reading even if you don't care about the IAM policy because it also serves as a compendium of privilege escalation techniques.
I bought us-east-1.com: A Look at Security, DNS Traffic, and Protecting AWS Users by Gabriel Koo

It's a story as old as time. You find a domain name that looks like it shouldn't be used for stuff but also looks like it's used for stuff. You smoke some weed and get an urge to buy said domain. You buy it and start getting traffic you shouldn't get and accidentally pwn some stuff. You're high so you panic and write a blog post to demonstrate your innocence. I'm not saying that’s how Gabriel did it, but I’m not not saying it either.

🥖 Palette Cleanser

📋 Chef's selections

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🤖 Dessert

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS Security Bulletins