Lex NevaAug 30
30
Monday August, 2021
SRE Weekly Issue #285
📖 [The CloudSecList] Issue 102
Marco from CloudSecListAug 29
[tl;dr sec] 98 - Cloud Security Orienteering, Last S3 Document You’ll Need
Clint at tl;dr secAug 26
IAM Access Analyzer helps you generate fine-grained policies that specify the required actions for more than 50 services
Aug 25
IAM Access Analyzer helps you achieve least privilege by generating fine-grained policies that specify the required actions for more than 50 services. In April 2021, IAM Access Analyzer added policy generation to help you create IAM policies based on your AWS CloudTrail activity. Now, we are extending policy generation to …
Amazon Elastic Compute Cloud - 2 updated methods
Aug 27
This release adds the BootMode flag to the ImportImage API and showing the detected BootMode of an ImportImage task.
Amazon EMR - 3 new 1 updated methods
Aug 27
Amazon EMR now supports auto-terminating idle EMR clusters. You can specify the idle timeout value when enabling auto-termination for both running and new clusters and Amazon EMR automatically terminates the cluster when idle timeout kicks in.
AWS Compute Optimizer - 1 new 6 updated methods
Aug 26
Adds support for 1) the AWS Graviton (AWS_ARM64) recommendation preference for Amazon EC2 instance and Auto Scaling group recommendations, and 2) the ability to get the enrollment statuses for all member accounts of an organization.
How to securely create and store your CRL for ACM Private CA
Tracy PierceAug 27
In this blog post, I show you how to protect your Amazon Simple Storage Service (Amazon S3) bucket while still allowing access to your AWS Certificate Manager (ACM) Private Certificate Authority (CA) certificate revocation list (CRL). A CRL is a list of certificates that have been revoked by the CA. …
AWS introduces changes to access denied errors for easier permissions troubleshooting
Gauravee GandhiAug 27
To help you more easily troubleshoot your permissions in Amazon Web Services (AWS), we’re introducing additional context in the access denied error messages. We’ll start to introduce this change in September 2021, and gradually make it available in all AWS services over the next few months. If you’re currently relying …
Use IAM Access Analyzer to generate IAM policies based on access activity found in your organization trail
Mathangi RameshAug 26
In April 2021, AWS Identity and Access Management (IAM) Access Analyzer added policy generation to help you create fine-grained policies based on AWS CloudTrail activity stored within your account. Now, we’re extending policy generation to enable you to generate policies based on access activity stored in a designated account. For …
Apply the principle of separation of duties to shell access to your EC2 instances
Vesselin TzvetkovAug 26
In this blog post, we will show you how you can use AWS Systems Manager Change Manager to control access to Amazon Elastic Compute Cloud (Amazon EC2) instance interactive shell sessions, to enforce separation of duties. Separation of duties is a design principle where more than one person’s approval is …
autoscaling: 1 new action
Aug 28
1 new action: GetPredictiveScalingForecast (retrieve the forecast data for a predictive scaling policy)
compute-optimizer: 1 new action
Aug 28
1 new action: GetEnrollmentStatusesForOrganization (get the enrollment statuses for member accounts of the organization)
mobiletargeting: 1 new action | 2 updated actions
Aug 28
1 new action: GetReports (mobiletargeting:getreports); 2 updated actions: GetApps (access), ListTagsForResource (access)
cloudfront: 2 updated actions
Aug 28
2 updated actions: CreateDistributionWithTags (access), CreateStreamingDistributionWithTags (access)
Pawel Rzepa @Rzepsky
🔥New blog post🔥
"#AWS privilege escalation: exploring odd features of the Trust Policy"
a.k.a.
how to assume an IAM role without "sts:AssumeRole" permission?
rzepsky.medium.com/aws-privilege-…
Clint Gibler @clintgibler
📓 163 page Threat Model of #AWS S3 by @djo_hk
Covers:
1. Best practices (best security/effort ratio)
2. Onboarding for large enterprises/agencies
3. Compliance mapping to demonstrate a risk-based approach and gap analysis
#cloudsecurity
trustoncloud.com/the-last-s3-se…
Scott Piper @0xdabbad00
Access Denied errors are going to say why type of policy is denying them! (SCP vs resource vs IAM vs boundary vs VPC end-point, etc.) This is going to be a huge help for debugging these.
AWS Blog Unofficial. @AWSBlogUnreal
The AWS Security, Identity & Compliance Blog #AWSSecurity
aws.amazon.com/blogs/security…
By: Guaravee Gandhi*
Kinnaird McQuade💥☁️ @kmcquade3
🔥🔥 Crazy exploit on Azure Cosmos DB. “In short, the [Jupyter] notebook container allowed for a privilege escalation into other customer notebooks… As a result, an attacker could gain access to customers’ Cosmos DB primary keys… and the notebook storage access token.”
sagitz @sagitz_
I'm excited to share information about our research, in which we (+@nirohfeld) found a critical vulnerability in Azure Cosmos DB itself - effectively allowing malicious actors to fully compromise databases of thousands of customers. @wiz_io #ChaosDB chaosdb.wiz.io
Clint Gibler @clintgibler
⚛️ Electron Hardener by @1Password
A @rustlang library and CLI tool to harden @electronjs binaries against runtime behavior modifications
github.com/1Password/elec…
Matt Fuller @matthewdfuller
Numerous cloud vendors ask for "ReadOnly" access via a managed policy. You should think long and hard about what you're actually giving them.
#AWS #cloud #security
posts.specterops.io/aws-readonlyac…
Scott Piper @0xdabbad00
There is now an EC2 IMDS end-point for IPv6 so there will be a new place to acquire creds beyond 169.254.169.254 at fd00:ec2::254. github.com/aws/aws-sdk-go…
The SDK started supporting it a few weeks, but looks like now EC2 has it.
github.com/aws/aws-sdk-go…
Brigid Johnson @bjohnso5y
😊Had a blast talking about AWS permissions at #reInforce with Karen and Jesse! Least privilege is one of my favorite thing to talk about. 🥳
stephenschmidt @StephenSchmidt
Coming in October: We are making it easier to protect sensitive data by offering free MFA devices to AWS account holders and Security Awareness Training. More details aws.amazon.com/blogs/security…
Matt Fuller @matthewdfuller
This is the holy grail for cloud adversaries: crossing the customer isolation boundaries of the service provider to access other customers' data.
#azure #cloud #security
sagitz @sagitz_
I'm excited to share information about our research, in which we (+@nirohfeld) found a critical vulnerability in Azure Cosmos DB itself - effectively allowing malicious actors to fully compromise databases of thousands of customers. @wiz_io #ChaosDB chaosdb.wiz.io
I presume you're all aware of 42.10
https://preview.redd.it/pd30dsv9kbk71.png?width=1906&format=png&auto=webp&s=69e421c4e7e0ce7e497f63d698953af54235b3e3
How to start learning cloud security?
Background: I have 5 years of industry experience as a front end developer. I am about to start a new job as a senior UI developer with a company that is into identity governance and cloud security. I want to learn more about cloud security in order to understand what …
- 🖊️ This newsletter was fwd to you? Subscribe here
- 💌 Want to suggest new content: contact me or reply to this email
- ⚡️ Powered by Mailbrew
- 🐦 Follow me on Twitter or hire me.
