Security Newsletter - Colonial pipeline news continued. Executive order on cybersecurity. FragAttacks Wifi vulnerabilities. • SRE Weekly Issue #270 • 📖 [The CloudSecList] Issue 87 • [tl;dr sec] #83 - Comparing Infra as Code Scanners, Jenkins Attack Framework • AWS Notification Message • AWS WAF adds support for log filtering • AWS Certificate Manager Private Certificate Authority is now available in the Asia Pacific (Osaka) Region • Amazon Elastic Compute Cloud - 22 updated methods • AWS Systems Manager Incident Manager Contacts - 27 new methods • AWS Systems Manager Incident Manager - 29 new methods • Amazon Elastic Kubernetes Service - 12 updated methods • Spring 2021 SOC 2 Type I Privacy report now available • Use EC2 Instance Connect to provide secure SSH access to EC2 instances with private IP addresses • AWS Systems Manager Incident Manager *inhales* is one of the worst launches I've seen in quite some time. I think <a href="https://twitter.com/pagerduty" target="_blank">@pagerduty</a> can breathe a sigh of relief. Here's my initial experience with the service, so you can judge for yourself. 1/ • ⚒️ <a href="https://twitter.com/NahamSec" target="_blank">@NahamSec</a> thread on popular <a href="https://twitter.com/Burp_Suite" target="_blank">@Burp_Suite</a> extensions Popular: * Logger++ * Param miner * Auth checking: Auto repeater, Autorize * Turbo intruder * Asset history * Collaborator everywhere * Active scan++ * Backslash powered scanner <a href="https://twitter.com/hashtag/bugbountytips" target="_blank">#bugbountytips</a> • The CFP is now open for fwd:cloudsec! <a href="https://t.co/PPhMKQSBzK" target="_blank">fwdcloudsec.org/cfp.html</a> The CFP closes on July 16th, but don't wait because all talks submitted within the first month will get feedback to resubmit. We hope this especially encourages those who have not spoken at a conference before. • To those who are saying that they might have upgraded their hashing algorithms - yes, you’re right. I am still often skeptical when I see a message like that. Especially when the site has some suspicious restrictions on which special characters you can’t use in your password • ✍️ tfsec VS <a href="https://twitter.com/code" target="_blank">@code</a> extension Scan your Terraform code for security issues right in your IDE H/T <a href="https://twitter.com/owenrum" target="_blank">@owenrum</a> <a href="https://t.co/7lPPXXGq7Q" target="_blank">marketplace.visualstudio.com/items?itemName…</a> • The CDC said fully vaccinated people can use wildcards in their IAM policies because they’re privileged • Well that was fun while it lasted. Please fix your service AWS 😡. 13/13 • Pickles is officially a unicorn! 🦄🦄🦄 • AWS CDK folks: am I the only one who finds it far, far more challenging to define a Step Function in CDK than using YAML? • Didn't workout for one week. Spider moved in behind my weights 🏋️‍♀️. You win Spider it's your workout basement now. 🕷️ • Why you should never work for Amazon itself: Some Amazon managers say they 'hire to fire' people just to meet the internal turnover goal every year • A favor for AWS: one way to display date and time • SR Solutions Architect interview tomorrow! • Introducing Incident Manager from AWS Systems Manager • AWS Local Zones Are Now Open in Boston, Miami, and Houston • Building your own evil HID injector USB cable • Send My: Arbitrary data transmission via Apple's Find My network • Biggest cloud security issues you see • AWS vs. Azure vs. Google Cloud: Comparing Cloud Platforms - Security Boulevard • AWS Bombing Plot Puts Renewed Focus on Data Center Physical Security - Data Center Knowledge • AWS configuration issues lead to exposure of 5 million records SC Magazine - SC Magazine