Issue #79
Monday · July 18, 2022
🥗 AWS security blogs
- AWS achieves TISAX certification (Information with Very High Protection Needs (AL3) — We’re excited to announce the completion of the Trusted Information Security Assessment Exchange (TISAX) certification on June 30, 2022 for 19 AWS Regions. These Regions achieved the Information with Very High Protection Needs (AL3) label for the control domains Information Handling and Data Protection. This alignment with TISAX requirements demonstrates …
- AWS achieves HDS certification to three additional Regions — We’re excited to announce that three additional AWS Regions—Asia Pacific (Korea), Europe (London), and Europe (Stockholm)—have been granted the Health Data Hosting (Hébergeur de Données de Santé, HDS) certification. This alignment with the HDS requirements demonstrates our continued commitment to adhere to the heightened expectations for cloud service providers. AWS …
- A sneak peek at the governance, risk, and compliance sessions for AWS re:Inforce 2022 — Register now with discount code SALUZwmdkJJ to get $150 off your full conference pass to AWS re:Inforce. For a limited time only and while supplies last. Today we want to tell you about some of the exciting governance, risk, and compliance sessions planned for AWS re:Inforce 2022. AWS re:Inforce is …
- Eligible customers can now order a free MFA security key — One of the best ways for individuals and businesses to protect themselves online is through multi-factor authentication (MFA). MFA offers an additional layer of protection to help prevent unauthorized individuals from gaining access to systems or data. In fall 2021, Amazon Web Services (AWS) Security began offering a free MFA …
🍛 Reddit threads on r/aws
📌 Newsletters
📌 Top Links from Security Folks
- Eligible customers can now order a free MFA security key | Amazon Web Services — One of the best ways for individuals and businesses to protect themselves online is through multi-factor authentication (MFA). MFA offers an additional layer of protection …
- Eligible customers can now order a free MFA security key | Amazon Web Services — One of the best ways for individuals and businesses to protect themselves online is through multi-factor authentication (MFA). MFA offers an additional layer of protection …
- GitHub - aquasecurity/chain-bench: An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark. — An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark. - GitHub - …
- Optimizing CI/CD Credential Hygiene - A Comparison of CI/CD Solutions — Attackers are always on the lookout to gain access to credentials, which are a critical asset to protect and are widespread throughout the organization.
📌 "AWS Security" on Google News
🧁 IAM permission changes
- rekognition: 1 new action | 3 updated resources — 1 new action: UpdateStreamProcessor (Grants permission to modify properties for a stream processor); 3 updated resources: collection (conditions), streamprocessor (conditions), projectversion (conditions)
- devops-guru: 2 new actions — 2 new actions: ListAnomalousLogGroups (Grants permission to list log anomalies of a given insight in your account), ListMonitoredResources (Grants permission to list resource monitored by DevOps Guru in your account)
- chime: 2 new actions — 2 new actions: BatchUpdateAttendeeCapabilitiesExcept (Grants permission to update AttendeeCapabilities except the capabilities listed in an ExcludedAttendeeIds table), UpdateAttendeeCapabilities (Grants permission to the capabilties that you want to update)
🍪 API changes
- Elastic Disaster Recovery Service - 5 updated methods — Changed existing APIs to allow choosing a dynamic volume type for replicating volumes, to reduce costs for customers.
- Amazon CloudWatch Evidently - 6 new 9 updated methods — This release adds support for the new segmentation feature.
- AWS WAFV2 - 8 updated methods — This SDK release provide customers ability to add sensitivity level for WAF SQLI Match Statements.
- CodeArtifact - 2 new 3 updated methods — This release introduces Package Origin Controls, a mechanism used to counteract Dependency Confusion attacks. Adds two new APIs, PutPackageOriginConfiguration and DescribePackage, and updates the ListPackage, DescribePackageVersion and ListPackageVersion APIs in support of the feature.
📺 AWS security bulletins
- Reported EKS IAM Authenticator Issue — Initial Publication Date: 2022/07/11 9:00 PST A security researcher recently reported an issue with the AWS IAM Authenticator for Kubernetes, used by Amazon Elastic Kubernetes Service (EKS). The researcher identified a query parameter validation issue within the authenticator plugin when configured to use the “AccessKeyID” template parameter within query strings. …
