Lex NevaMar 28
28
Monday March, 2022
📢 MAMIP (Monitor AWS Managed IAM Policies)
Policies changed since last week:
- AWSIdentitySyncFullAccess
- AWSIdentitySyncReadOnlyAccess
- AWSMigrationHubRefactorSpacesFullAccess
- AWSSSODirectoryAdministrator
- AWSSSODirectoryReadOnly
- AWSSSOMasterAccountAdministrator
- AWSSSOMemberAccountAdministrator
- AmazonEKSWorkerNodePolicy
- AmazonRDSServiceRolePolicy
- AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy
SRE Weekly Issue #315
📖 [The CloudSecList] Issue 130
Marco from CloudSecListMar 27
[tl;dr sec] #125 - Hacking a Billionaire, Automating Incident Response in AWS
Clint at tl;dr secMar 24
Amazon Elastic Compute Cloud - 3 updated methods
Mar 25
This is release adds support for Amazon VPC Reachability Analyzer to analyze path through a Transit Gateway.
Amazon Simple Systems Manager (SSM) - 9 updated methods
Mar 25
This Patch Manager release supports creating, updating, and deleting Patch Baselines for Rocky Linux OS.
AWS Config - 2 new 17 updated methods
Mar 24
Added new APIs GetCustomRulePolicy and GetOrganizationCustomRulePolicy, and updated existing APIs PutConfigRule, DescribeConfigRule, DescribeConfigRuleEvaluationStatus, PutOrganizationConfigRule, DescribeConfigRule to support a new feature for building AWS Config rules with AWS CloudFormation Guard
AWS Lambda - 8 updated methods
Mar 24
Adds support for increased ephemeral storage (/tmp) up to 10GB for Lambda functions. Customers can now provision up to 10 GB of ephemeral storage per function instance, a 20x increase over the previous limit of 512 MB.
ISO/IEC 27001 certificates now available in French and Spanish
Rodrigo FiuzaMar 23
French version Spanish version We continue to listen to our customers, regulators, and stakeholders to understand their needs regarding audit, assurance, certification, and attestation programs at Amazon Web Services (AWS). We are pleased to announce that ISO/IEC 27001 certificates for AWS are now available in French and Spanish on AWS …
How to use AWS Security Hub and Amazon OpenSearch Service for SIEM
Ely KahnMar 21
AWS Security Hub provides you with a consolidated view of your security posture in Amazon Web Services (AWS) and helps you check your environment against security standards and current AWS security recommendations. Although Security Hub has some similarities to security information and event management (SIEM) tools, it is not designed …
ec2: 3 new actions, 1 new resource | 1 updated action
Mar 26
3 new actions: DeleteResourcePolicy (Grants permission to remove an IAM policy that enables cross-account sharing from a resource), GetResourcePolicy (Grants permission to describe an IAM policy that enables cross-account sharing), PutResourcePolicy (Grants permission to attach an IAM policy that enables cross-account sharing to a resource); 1 new resource: group; 1 …
quicksight: 2 new actions
Mar 25
2 new actions: DescribeGroupMembership (Grants permission to describe a QuickSight group member), SearchGroups (Grants permission to search for a sub-set of QuickSight groups)
s3-outposts: 1 new action
Mar 25
1 new action: ListSharedEndpoints (Grants permission to list shared endpoints)
Christophe @christophetd
Did you know that Dirty Pipe could also be used to escape unprivileged containers and gain root access on a Kubernetes host?
📖 Write-up: datadoghq.com/blog/engineeri…
👀 Proof of concept: github.com/datadog/dirtyp…
A thread on how it's done. 🧵⬇️
476
200Mar 25 · 6:05 PM
Alexandre Sieira @AlexandreSieira
Advanced Persistent Teenager
briankrebs @briankrebs
Experts say the LAPSUS$ data extortion group that hit Okta and Microsoft this week is run by a 17-year-old from the UK who recently bought the Doxbin doxing website, and then leaked its database. Naturally, Doxbin responded by doxing the LAPSUS$ leader. krebsonsecurity.com/2022/03/a-clos…
51370Mar 24 · 2:51 PM Christophe @christophetd
"Fantastic AWS Hacks and Where to Find Them" - Getting started in AWS security, and how companies are getting hacked on AWS
📖Slides: dtdg.co/fantastic-aws-…
🧠Mindmap: mindmeister.com/map/2211520103…
🎨 by @MindsEyeCCF
17262Mar 23 · 3:38 PM
Marco Lancini @lancinimarco
Just blogged: "What to look for when reviewing a company's infrastructure" - A comprehensive guide that provides a structured approach to reviewing the security architecture of a multi-cloud SaaS company and finding its most critical components. marcolancini.it/2022/blog-clou…
14948Mar 24 · 5:05 PM
Nick Jones @nojonesuk
#hugops to everyone in the Okta security team this week, it’s going to be a long one. For orgs using Okta, the details aren’t clear, so I’d be threat hunting for successful auths to services where there’s no matching okra session (a la golden SAML). I’d also be looking for…
vx-underground @vxunderground
LAPSUS$ extortion group claims to have breached @okta. They have released 8 photos as proof.
The photos we are sharing has been edited so no sensitive information or user identities are displayed.
Image 1 - 4 attached below.
5516Mar 22 · 9:20 AM
Brigid Johnson @bjohnso5y
Let's talk flexible work hours. I usually don't work on Fridays afternoons. My brain is fried 🧠 🍳. I love working on Sundays. I get to explore my thinky thoughts with a clear mind. This is today.
560Mar 28 · 1:25 AM
Scott Piper @0xdabbad00
This appears to be legit. Sent to my flaws.cloud root email. Apparently AWS may now close your account if you don't respond within 5 days to what they think is a security incident, but there is no support case in the account to respond to (and no closed cases). 🤔
434Mar 22 · 2:15 PM Scott Piper @0xdabbad00
Huh. Someone emailed me that flAWS was broken, for the final level related to Lambda. I got an AccessDenied trying look at the Lambda service, while logged in as root, no SCPs on the account. EC2, IAM, S3, all work. Created root access key, still AccessDenied for only Lambda. 🤔
Scott Piper @0xdabbad00
This appears to be legit. Sent to my flaws.cloud root email. Apparently AWS may now close your account if you don't respond within 5 days to what they think is a security incident, but there is no support case in the account to respond to (and no closed cases). 🤔
349Mar 23 · 2:04 AM
Aidan W Steele @__steele
What performance are people getting from the new Lambda ephemeral storage? My results when running `npm ci` (575 MB written) inside Lambda:
/tmp
38 secs
108K writes
= ~15MB/s, ~2800 IOPS
EFS
180 secs
252K writes
= ~3MB/s, ~1400 IOPS
4-5x faster is nice, but less than expected
365Mar 25 · 5:55 AM
Clint Gibler @clintgibler
🗡️ How we found vulnerabilities in GitHub Actions CI/CD pipelines
@_alex_il_ describes vulnerable patterns in GitHub Actions that can lead to an attacker being able to steal secrets, inject code, etc.
+ mitigations on how to keep this from happening
cycode.com/blog/github-ac…
2812Mar 22 · 6:00 PM
200k members. Congrats to /r/aws!
It has been great to see this community grow. Please let us know what is working well and what can be improved.
Some recent updates: * Twitter links are now allowed * We are working on some more AMAs (suggestions welcome) * For now we've pinned the MFA message to …
Cloud Security Certification
I am new to cloud security. I am looking for some suggestions around which cloud security certifications should I start with and what are the resources that I would/ should refer to prepare for these certifications?
- 🖊️ This newsletter was forwarded to you? Subscribe here
- 📢 Promote your content with Sponsorship
- 💌 Want to suggest new content: contact me or reply to this email
