Lex NevaFeb 07
7
Monday February, 2022
I'm opening sponsorship on AWS Security Digest. Please contact me, if you want to promote AWS Security related content.
📢 MAMIP (Monitor AWS Managed IAM Policies)
Policies changed since last week:
SRE Weekly Issue #308
📖 [The CloudSecList] Issue 123
Marco from CloudSecListFeb 06
[tl;dr sec] #118 - Atomic Red Team for Cloud, Security Program Building
Clint at tl;dr secFeb 03
Amazon Athena - 6 updated methods
Feb 4
You can now optionally specify the account ID that you expect to be the owner of your query results output location bucket in Athena. If the account ID of the query results bucket owner does not match the specified account ID, attempts to output to the bucket will fail with …
AWSMarketplace Metering - 1 updated methods
Feb 3
Add CustomerAWSAccountId to ResolveCustomer API response and increase UsageAllocation limit to 2500.
How to build a multi-Region AWS Security Hub analytic pipeline and visualize Security Hub data
David HesslerFeb 4
AWS Security Hub is a service that gives you aggregated visibility into your security and compliance posture across multiple Amazon Web Services (AWS) accounts. By joining Security Hub with Amazon QuickSight—a scalable, serverless, embeddable, machine learning-powered business intelligence (BI) service built for the cloud—your senior leaders and decision-makers can use …
AWS cloud services adhere to CISPE Data Protection Code of Conduct for added GDPR assurance
Chad WoolfFeb 3
French version German version I’m happy to announce that AWS has declared 52 services under the Cloud Infrastructure Service Providers Europe Data Protection Code of Conduct (CISPE Code). This provides an independent verification and an added level of assurance to our customers that our cloud services can be used in …
How to configure rotation windows for secrets stored in AWS Secrets Manager
Fatima AhmedFeb 2
AWS Secrets Manager now enables you to specify a rotation window for each secret stored. With this launch, you can continue to follow best practice of regularly rotating your secrets, while using the defined time window of your choice. With Secrets Manager, you can manage, retrieve, and rotate database credentials, …
Security practices in AWS multi-tenant SaaS environments
Keith PJan 31
Securing software-as-a-service (SaaS) applications is a top priority for all application architects and developers. Doing so in an environment shared by multiple tenants can be even more challenging. Identity frameworks and concepts can take time to understand, and forming tenant isolation in these environments requires deep understanding of different tools …
fis: 2 new actions
Feb 5
2 new actions: GetTargetResourceType (get information about the specified resource type), ListTargetResourceTypes (list the resource types)
comprehend: 4 new actions
Feb 4
4 new actions: DeleteResourcePolicy (remove policy on resource), DescribeResourcePolicy (read attached policy on resource), ImportModel (import a trained comprehend model), PutResourcePolicy (attach policy to resource)
medialive: 3 updated actions
Feb 4
3 updated actions: BatchDelete (resources), BatchStart (resources), BatchStop (resources)
Aidan W Steele @__steele
Today one of my AWS IAM access keys turned 3,000 days old.
But I don’t know what’s using it. I think I will turn on CloudTrail data events to get to the bottom of it.
What’s your oldest key?
Marco Lancini @lancinimarco
I've just open sourced a small Terraform module which automates the setup of OIDC federation between AWS and Github Actions/Gitlab CI:
github.com/marco-lancini/…
Aidan W Steele @__steele
In the following AWS VPC architectures, can you send data from:
A -> B?
B -> A?
A -> C?
C -> A?
What path do the packets (attempt to) take? What about the return path?
The answers genuinely surprised me and has got me questioning my mental model of VPCs.
Dan Urson @notdurson
I'm just going to put this out there: gatekeeping is one of the worst traits in humans, and if it's the only way you can make yourself feel good you should rethink your life.
Scott Piper @0xdabbad00
No AWS SDK updates yesterday or today reminds me that it is annual performance review week at AWS.
Scott Piper @0xdabbad00
Reminder to vendors: If your product deploys EC2s in customer environments without IMDSv2, I am going to be putting you on a public shame list. This includes AWS's own features such as their new EC2 fast launch that doesn't work if you enforce IMDSv2.
What’s New on AWS @awswhatsnew
AWS Announces New Launch Speed Optimizations for Microsoft Windows Server Instances on Amazon EC2
Today AWS announced the ability to launch Microsoft Windows Server instances up to 65% faster on Amazon Elastic Compute Cloud (EC2). Customers can fla... aws.amazon.com/about-aws/what…
Kinnaird McQuade💥🌩 @kmcquade3
When I was in security consulting, I was telling management about scanning Terraform, securing CI/CD, golden images, overprivileged roles, etc. They didn’t think those were important and were stuck in the past.
5 years later, it’s now standard architecture. I feel vindicated.
Christophe @christophetd
Stratus Red Team v1.2.0 adds:
• Documentation for detecting common attack techniques using CloudTrail, GuardDuty, Access Analyzer
• 2 new attack techniques (discovery & exploitation of EC2 user data)
👉 github.com/DataDog/stratu…
📈 Next up: Support for common Kubernetes TTPs!
Christophe @christophetd
📢 Today, I'm thrilled to announce "Stratus Red Team", an open-source adversary emulation tool for the cloud!
Comes with a catalog of cloud-native attack techniques that you can easily detonate to test your threat detection.
github.com/Datadog/stratu…
📝blog.christophetd.fr/introducing-st…
Nick Jones @nojonesuk
I’m seeing this article get circled round, and it’s not incorrect, but the only advice regarding AWS IAM users that matters is that you should purge the bloody things from your environment wherever possible. Set up an SSO and use roles for everything.
iampulse.com/articles/aws-i…
Dan Urson @notdurson
You asked, so I'll deliver. This is what I know about responsible disclosure/#CVD/how to report security issues in other people’s software. Call it "10 Commandments of Durson" if you want. 🧵
Why is it recommended to avoid S3 bucket for serving video?
I was going to allow certain users to upload relatively small videos of 50mb or less.
I've heard an s3 bucket isn't good for serving videos. Is this mostly because of the costs? Or speed? Or other reasons?
For 50mb videos would an s3 bucket serving video still be problematic? …
Is there a way to escalate ignored support ticket?
I have problem with corrupted system table in Aurora. I have searched everywhere and the only solution seems to be "write AWS support ticket and they will fix it". I have developer support which costs me $350/month, so I created support ticket (9520368991) but it is still "unassigned" after 10 …
Is there a good tool to “map” out AWS infrastructure in your account?
I would like to be able to pass a starting point to a tool, say an EC2 for example, and then it builds a list of dependencies, like any Security Groups, policies, ALB’s that use it, etc. Either as a diagram or at least as a list or something useful. …
How to monitor different SaaS solutions? The company I work for uses hundreds if not thousands of SaaS solutions from a variety of Independent Software Vendors who mostly use the usual culprits (AWS, Azure, GCP, Oracle) as their hosting providers.
My question is is there a way/tool I could fetch log events from all these solutions and aggregate in a single account and therefore have a single point of truth as well as some visibility for security?
- 🖊️ This newsletter was forwarded to you? Subscribe here
- 📢 Promote your content with Sponsorship
- 💌 Want to suggest new content: contact me or reply to this email
