Lex NevaMay 02
2
Monday May, 2022
📢 MAMIP (Monitor AWS Managed IAM Policies)
Policies changed since last week:
- AWSApplicationMigrationFullAccess
- AWSApplicationMigrationReadOnlyAccess
- AWSAuditManagerAdministratorAccess
- AWSSSOMasterAccountAdministrator
- AWSSSOMemberAccountAdministrator
- AWSSSOReadOnly
- AWSSupportServiceRolePolicy
- AmazonLexReadOnly
- AmazonSageMakerGroundTruthExecution
- ComprehendReadOnly
SRE Weekly Issue #320
📖 [The CloudSecList] Issue 135
Marco from CloudSecListMay 01
[tl;dr sec] #130 - Project Zero on 0day Trends, ThinkstScapes
Clint at tl;dr secApr 28
Amazon CodeGuru Reviewer - 3 updated methods
Apr 29
Amazon CodeGuru Reviewer now supports suppressing recommendations from being generated on specific files and directories.
AWS Elemental MediaConvert - 11 updated methods
Apr 29
AWS Elemental MediaConvert SDK nows supports creation of Dolby Vision profile 8.1, the ability to generate black frames of video, and introduces audio-only DASH and CMAF support.
Amazon Relational Database Service - 16 updated methods
Apr 29
Feature - Adds support for Internet Protocol Version 6 (IPv6) on RDS database instances.
Amazon Simple Systems Manager (SSM) - 3 updated methods
Apr 29
Update the StartChangeRequestExecution, adding TargetMaps to the Runbook parameter
New IDC whitepaper released – Trusted Cloud: Overcoming the Tension Between Data Sovereignty and Accelerated Digital Transformation
Marta TaggartApr 27
A new International Data Corporation (IDC) whitepaper sponsored by AWS, Trusted Cloud: Overcoming the Tension Between Data Sovereignty and Accelerated Digital Transformation, examines the importance of the cloud in building the future of digital EU organizations. IDC predicts that 70% of CEOs of large European organizations will be incentivized to …
How to control access to AWS resources based on AWS account, OU, or organization
Rishi MehrotraApr 27
AWS Identity and Access Management (IAM) recently launched new condition keys to make it simpler to control access to your resources along your Amazon Web Services (AWS) organizational boundaries. AWS recommends that you set up multiple accounts as your workloads grow, and you can use multiple AWS accounts to isolate …
Extend your pre-commit hooks with AWS CloudFormation Guard
Joaquin Manuel RinaudoApr 26
Git hooks are scripts that extend Git functionality when certain events and actions occur during code development. Developer teams often use Git hooks to perform quality checks before they commit their code changes. For example, see the blog post Use Git pre-commit hooks to avoid AWS CloudFormation errors for a …
LGPD workbook for AWS customers managing personally identifiable information in Brazil
Rodrigo FiuzaApr 25
Portuguese version AWS is pleased to announce the publication of the Brazil General Data Protection Law Workbook. The General Data Protection Law (LGPD) in Brazil was first published on 14 August 2018, and started its applicability on 18 August 2020. Companies that manage personally identifiable information (PII) in Brazil as …
iotwireless: 6 new actions, 1 new resource | 8 updated actions
Apr 29
6 new actions: CreateNetworkAnalyzerConfiguration (Grants permission to create a NetworkAnalyzerConfiguration resource), DeleteNetworkAnalyzerConfiguration (Grants permission to delete the NetworkAnalyzerConfiguration), GetEventConfigurationsByResourceTypes (Grants permission to get event configurations by resource types), ListEventConfigurations (Grants permission to list information of available event configurations based on the AWS account), ListNetworkAnalyzerConfigurations (Grants permission to list information of …
The OPA AWS CloudFormation Hook
Learn more about AWS CloudFormation Hook and how Open Policy Agent may be used for CloudFormation policy enforcement.
Clint Gibler 🪝 @OpenPolicyAgent + AWS CloudFormation Hook How to use the new AWS CloudFormation Hook feature to allow custom code to intercept a resource on its …
rowan Nice to see an official Open Policy Agent CloudFormation Hook! Check out the blog blog.styra.com/blog/the-opa-a… the code github.com/StyraInc/opa-a… …
Wiz Research discovers "ExtraReplica"— a cross-account database vulnerability in Azure PostgreSQL
Tenant isolation is a fundamental premise of the cloud. Organizations trust that the cloud services they use, especially high value assets such as databases, are …
Zack Glick Those @wiz_io folks at it again. Interesting write up about their exploration of a shared tenant service. When we get around to building @MITREatt…
Kinnaird McQuade Dear god. Another insane cross-account vulnerability in an Azure database service found by the @wiz_io research team 🔥 first CosmosDB, & now Pos…
Brigid Johnson @bjohnso5y
We have some new best friends in town!! These are powerful condition keys to help you establish an organizational boundary. 👏 🎉
AWS Identity @AWSIdentity
We've launched 3 new condition keys to help you to control access along your AWS organizational boundaries:
🔑 aws:ResourceOrgID
🔑 aws:ResourceOrgPaths
🔑 aws:ResourceAccount
Learn how to get started. go.aws/3LpD74q
72
15Apr 27 · 11:23 PM
Scott Piper @0xdabbad00
aws:ResourceOrgID has arrived
AWS Blog Unofficial. @AWSBlogUnreal
The AWS Security, Identity & Compliance Blog #AWSSecurity
aws.amazon.com/blogs/security…
By: Rishi Mehrotra* and Michael Switzer
789Apr 27 · 8:08 PM
Kinnaird McQuade @kmcquade3
AWS IAM came out with 3 new condition keys that can help you establish a Data Perimeter and prevent exfiltration etc.
If you remember the Endgame tool that showed how to blast open resource policies & share things with the world - this will prevent that. 🔥
Great work, AWS team
AWS Identity @AWSIdentity
We've launched 3 new condition keys to help you to control access along your AWS organizational boundaries:
🔑 aws:ResourceOrgID
🔑 aws:ResourceOrgPaths
🔑 aws:ResourceAccount
Learn how to get started. go.aws/3LpD74q
596Apr 28 · 3:28 AM Zack Glick @z1g1
How to control access to AWS resources based on AWS account, OU, or organization | AWS Security Blog. Going to be a super helpful relay for orgs looking to keep shadow cloud resources out of sensitive places aws.amazon.com/blogs/security…
3911Apr 27 · 11:31 PM
Christophe @christophetd
If you haven't submitted a talk proposal to fwd:cloudsec, you should! It's a great (if not the best) cloud security conference happening in Boston on July 25th.
fwdcloudsec.org/cfp.html
Below are a few things I'd *love* to see. 🧵⬇️
fwd:cloudsec @fwdcloudsec
You now can (and should!) submit talks fwd:cloudsec! fwdcloudsec.org/cfp.html
We just sent out updates to the mailing list:
- The conference will be one day at District Hall in Boston, MA on July 25th (the day before re:Inforce).
- Tickets will go on sale April 18th at noon ET
2513Apr 27 · 11:26 AM Clint Gibler @clintgibler
🧪 @datadoghq Security Labs Repo
Information, exploits, and scripts
Currently contains PoCs for:
* Dirty Pipe container breakout
* Spring4Shell
* JWT Null Signature Vulnerability
By @christophetd & @andrewkrug
github.com/DataDog/securi…
298Apr 25 · 9:00 PM Scott Piper @0xdabbad00
AWS breaking changes coming up:
April 30: Lambda ARNs are changing in IAM policies when versions or aliases are referenced: forum.serverless.com/t/lambda-secur…
May 18: GovCloud RDS TLS certs are changing. github.com/SummitRoute/aw…
269Apr 26 · 6:09 PM
Ian Mckay @iann0036
This was long overdue! 🔑🔑
CFN Updates @cfnupdates
New AWS::EC2::KeyPair
Use the KeyPair resource to create or import a key pair.
docs.aws.amazon.com/AWSCloudFormat… #ec2 #cloudformation
340Apr 30 · 8:09 AM
You have a magic wand, which when waved, let's you change anything about one AWS service. What do you change and why?
Yes, of course you could make the service cheaper, I'm really wondering what people see as big gaps in the AWS services that they use.
If I had just one option here, I'd probably go for a deeper integration between Aurora Postgres and IAM. You can use IAM roles to …
- 🖊️ This newsletter was forwarded to you? Subscribe here
- 📢 Promote your content with ASD Sponsorship
- 💌 Want to suggest new content: contact me or reply to this email