Lex NevaFeb 28
28
Monday February, 2022
Fix AWS IAM permissions quickly with k9 Security (Sponsor)
AWS IAM is hard. But now Cloud teams can fix IAM permissions problems quickly. Today.
Find unexpected access with simple IAM access reports and alerts. Fix IAM with processes and Terraform/CDK automation your entire team can use.
📢 MAMIP (Monitor AWS Managed IAM Policies)
Policies changed since last week:
- AWSAppRunnerReadOnlyAccess
- AWSApplicationMigrationFullAccess
- AWSBackupServiceRolePolicyForS3Backup
- AmazonRDSBetaServiceRolePolicy
- AmazonRDSPreviewServiceRolePolicy
- AmazonRDSServiceRolePolicy
- AmazonRedshiftQueryEditorV2FullAccess
- AmazonRedshiftQueryEditorV2NoSharing
- AmazonRedshiftQueryEditorV2ReadSharing
- etc...
SRE Weekly Issue #311
📖 [The CloudSecList] Issue 126
Marco from CloudSecListFeb 27
[tl;dr sec] #121 - Container Security Checklist, DevSecOps & Automating Compliance
Clint at tl;dr secFeb 24
Auto Scaling - 3 updated methods
Feb 24
You can now hibernate instances in a warm pool to stop instances without deleting their RAM contents. You can now also return instances to the warm pool on scale in, instead of always terminating capacity that you will need later.
AWS Glue DataBrew - 6 updated methods
Feb 24
This AWS Glue Databrew release adds feature to merge job outputs into a max number of files for S3 File output type.
Firewall Management Service - 4 updated methods
Feb 24
AWS Firewall Manager now supports the configuration of AWS Network Firewall policies with either centralized or distributed deployment models. This release also adds support for custom endpoint configuration, where you can choose which Availability Zones to create firewall endpoints in.
Amazon Lightsail - 3 updated methods
Feb 24
This release adds support to delete and create Lightsail default key pairs that you can use with Lightsail instances.
Scaling cross-account AWS KMS–encrypted Amazon S3 bucket access using ABAC
Jorg HuserFeb 23
This blog post shows you how to share encrypted Amazon Simple Storage Service (Amazon S3) buckets across accounts on a multi-tenant data lake. Our objective is to show scalability over a larger volume of accounts that can access the data lake, in a scenario where there is one central account …
What is cryptographic computing? A conversation with two AWS experts
Supriya AnandFeb 23
Joan Feigenbaum Amazon Scholar, AWS Cryptography Bill Horne Principal Product Manager, AWS Cryptography AWS Cryptography tools and services use a wide range of encryption and storage technologies that can help customers protect their data both at rest and in transit. In some instances, customers also require protection of their data …
AWS achieves FedRAMP P-ATO for 15 services in the AWS US East/West and AWS GovCloud (US) Regions
Alexis RobinsonFeb 22
AWS is pleased to announce that 15 additional AWS services have achieved Provisional Authority to Operate (P-ATO) from the Federal Risk and Authorization Management Program (FedRAMP) Joint Authorization Board (JAB). AWS is continually expanding the scope of our compliance programs to help customers use authorized services for sensitive and regulated …
Fine-tune and optimize AWS WAF Bot Control mitigation capability
Dmitriy NovikovFeb 22
Introduction A few years ago at Sydney Summit, I had an excellent question from one of our attendees. She asked me to help her design a cost-effective, reliable, and not overcomplicated solution for protection against simple bots for her web-facing resources on Amazon Web Services (AWS). I remember the occasion …
greengrass: 2 updated conditions, 1 updated action
Feb 26
2 updated conditions: aws:MultiFactorAuthPresent (type), aws:SecureTransport (type); 1 updated action: StartBulkDeployment (conditions)
s3: 2 new actions
Feb 26
2 new actions: GetObjectAttributes (retrieve attributes related to a specific object), GetObjectVersionAttributes (retrieve attributes related to a specific version of an object)
outposts: 2 new actions
Feb 26
2 new actions: CreatePrivateConnectivityConfig (create a private connectivity configuration), GetPrivateConnectivityConfig (get a private connectivity configuration)
GitHub - SummitRoute/imdsv2_wall_of_shame: List of vendors that do not allow IMDSv2 enforcement
List of vendors that do not allow IMDSv2 enforcement - GitHub - SummitRoute/imdsv2_wall_of_shame: List of vendors that do not allow IMDSv2 enforcement
Scott Piper Just added @F5 BIG-IP products to the IMDSv2 Wall of Shame. Security products are showing up too much on this list of products that are harmful to cl…
Kinnaird McQuade💥🌩 Fyi @0xdabbad00 I’ll make a PR to the wall of shame github.com/SummitRoute/im…
Christophe Yet another SSRF vulnerability allowing to access the AWS IMDS to steal credentials. It's getting urgent to enforce IMDSv2 everywhere and ensure ven…
Themes From Momentum Cyber's 2022 Cybersecurity Almanac
Interesting themes about the business of cybersecurity from the best data in the industry.
Marco Lancini This is such an insightful read, covering interesting themes about the business of cybersecurity, and where the industry is heading strategyofsecurit…
Christophe Great market analysis of the security space in 2021 by @MomentumCyber: momentumcyber.com/docs/Yearly/20… summary at strategyofsecurity.com/themes-f…
Clint Gibler @clintgibler
✅ Container Security Checklist
💯 overview and distillation by @krol_valencia with actionable steps, links, and commands covering securing the:
* Build
* Container registry
* Container runtime
* Infrastructure
* Data
* Workloads
github.com/krol3/containe…
Zack Glick @z1g1
Excited to say that the new job is off to the races. I’m taking a break from incident response and I’ve joined New Relic as a principal security engineer in their product security org.
Scott Piper @0xdabbad00
Just added @F5 BIG-IP products to the IMDSv2 Wall of Shame. Security products are showing up too much on this list of products that are harmful to cloud security. 😔 github.com/SummitRoute/im…
Aidan W Steele @__steele
This is exactly what 90% of every Australian road trip looks like.
Scott Piper @0xdabbad00
They're using an IAM user access key on an EC2? 😭
TrainOfError @TrainOfError
@0xdabbad00 @F5 Can't get hacked with IMDSv1 if you don't use instance roles: docs.paloaltonetworks.com/vm-series/8-1/…
Steven Bryen @steven_bryen
Slack is down - do I have to open a chime room?
Christophe @christophetd
Yet another SSRF vulnerability allowing to access the AWS IMDS to steal credentials.
It's getting urgent to enforce IMDSv2 everywhere and ensure vendors allow to do so github.com/SummitRoute/im…
Recent SSRF with same impact in Dropbox's Hellosign: hackerone.com/reports/1406938
publiclyDisclosed @disclosedh1
Acronis disclosed a bug submitted by @lu3ky13: hackerone.com/reports/1241149 #hackerone #bugbounty
Clint Gibler @clintgibler
Protect yourself from subdomain takeovers by... proactively taking over your vulnerable domains before attackers can.
@paulschwarzen describes how OVO does so, automatically within minutes
Tool: github.com/ovotech/domain…
tech.ovoenergy.com/ovo-vs-bug-bou…
Aidan W Steele @__steele
I am coming to appreciate the AWS costs being visible on the dashboard. No way I would have guessed this account was incurring this large a bill.
Bonus: guess what caused this.
Brigid Johnson @bjohnso5y
🏷️Tags, IAM conditions, Amazon ECS....ABAC! 🏷️
tinyurl.com/3v5jxapk
Will AWS work in Russia after Ukraine war?
Hello. I live in Russia and I have a small mobile game hosted on Amazon Web Services. As I know, US wanna impose sanctions on Russia due to Ukraine conflicts. My app use serverless services (GameLift, Lambda, S3, DynamoDB, API Gateway, Cognito) that hard to bear out from provider. I …
Granted: a CLI to access the AWS console for multiple accounts and regions at once
Hey r/aws!
I find the AWS Console to be useful even though I mostly use APIs or infrastructure-as-code to interact with AWS. It’s good to have an out of the box tool to explore resources or look at logs and metrics for my services. A frustration that I frequently run …
- 🖊️ This newsletter was forwarded to you? Subscribe here
- 📢 Promote your content with Sponsorship
- 💌 Want to suggest new content: contact me or reply to this email
