AWS Security Digest

ASD Logo

18

Monday July, 2022

Sponsor

Besides AWS Security Digest Newsletter and building a SaaS product to save your money from AWS Invoice knock, I'm also running an AWS Consulting boutique (zoph.io) specialized in AWS Security and Architecture. Don't hesitate to drop me a mail or schedule a 30 minutes meeting with me to discuss your project or AWS pain points.

In a nutshell

Digital Nomad Life, this issue was crafted in the french Alpes. Recharging for a few weeks before intense weeks ahead (re:Inforce, fwd:Cloudsec).

Killed by AWS: AWS seems to deprecate Amazon WorkLink service. It's rare enough to be mentioned.

I'm removing two sections of ASD (r/cloudsec and r/netsec) to keep it digest (target read time: 2-3 min)

🔦 Highlight of the week

📢 MAMIP (Monitor AWS Managed IAM Policies)

Policies changed since last week:

Weekly diff

👉🏻 From AWS Bots: 📃 MAMIP / 🤖 MASE / 👮🏻‍♂️ MGDA

Newsletters

SRE Weekly Issue #330

Lex NevaJul 18

📖 [The CloudSecList] Issue 146

Marco from CloudSecListJul 17

[tl;dr sec] #141 - CIS Supply Chain Security Guide, Static Analysis on Binaries

Clint at tl;dr secJul 14

AWS API Changes

Elastic Disaster Recovery Service - 5 updated methods

Jul 15

Changed existing APIs to allow choosing a dynamic volume type for replicating volumes, to reduce costs for customers.

Amazon CloudWatch Evidently - 6 new 9 updated methods

Jul 15

This release adds support for the new segmentation feature.

AWS WAFV2 - 8 updated methods

Jul 15

This SDK release provide customers ability to add sensitivity level for WAF SQLI Match Statements.

CodeArtifact - 2 new 3 updated methods

Jul 14

This release introduces Package Origin Controls, a mechanism used to counteract Dependency Confusion attacks. Adds two new APIs, PutPackageOriginConfiguration and DescribePackage, and updates the ListPackage, DescribePackageVersion and ListPackageVersion APIs in support of the feature.

Security Bulletins

Reported EKS IAM Authenticator Issue

aws@amazon.comJul 11

Initial Publication Date: 2022/07/11 9:00 PST

A security researcher recently reported an issue with the AWS IAM Authenticator for Kubernetes, used by Amazon Elastic Kubernetes Service (EKS). The researcher identified a query parameter validation issue within the authenticator plugin when configured to use the “AccessKeyID” template parameter within query strings. …

AWS Security Blog

AWS achieves TISAX certification (Information with Very High Protection Needs (AL3)

Janice LeungJul 15

We’re excited to announce the completion of the Trusted Information Security Assessment Exchange (TISAX) certification on June 30, 2022 for 19 AWS Regions. These Regions achieved the Information with Very High Protection Needs (AL3) label for the control domains Information Handling and Data Protection. This alignment with TISAX requirements demonstrates …

AWS achieves HDS certification to three additional Regions

Janice LeungJul 15

We’re excited to announce that three additional AWS Regions—Asia Pacific (Korea), Europe (London), and Europe (Stockholm)—have been granted the Health Data Hosting (Hébergeur de Données de Santé, HDS) certification. This alignment with the HDS requirements demonstrates our continued commitment to adhere to the heightened expectations for cloud service providers. AWS …

A sneak peek at the governance, risk, and compliance sessions for AWS re:Inforce 2022

Greg EppelJul 11

Register now with discount code SALUZwmdkJJ to get $150 off your full conference pass to AWS re:Inforce. For a limited time only and while supplies last. Today we want to tell you about some of the exciting governance, risk, and compliance sessions planned for AWS re:Inforce 2022. AWS re:Inforce is …

Eligible customers can now order a free MFA security key

CJ MosesJul 11

One of the best ways for individuals and businesses to protect themselves online is through multi-factor authentication (MFA). MFA offers an additional layer of protection to help prevent unauthorized individuals from gaining access to systems or data. In fall 2021, Amazon Web Services (AWS) Security began offering a free MFA …

IAM Permission Changes

rekognition: 1 new action | 3 updated resources

Jul 18

1 new action: UpdateStreamProcessor (Grants permission to modify properties for a stream processor); 3 updated resources: collection (conditions), streamprocessor (conditions), projectversion (conditions)

devops-guru: 2 new actions

Jul 18

2 new actions: ListAnomalousLogGroups (Grants permission to list log anomalies of a given insight in your account), ListMonitoredResources (Grants permission to list resource monitored by DevOps Guru in your account)

chime: 2 new actions

Jul 18

2 new actions: BatchUpdateAttendeeCapabilitiesExcept (Grants permission to update AttendeeCapabilities except the capabilities listed in an ExcludedAttendeeIds table), UpdateAttendeeCapabilities (Grants permission to the capabilties that you want to update)

Top Links from Security Folks

Eligible customers can now order a free MFA security key | Amazon Web Services

aws.amazon.com

One of the best ways for individuals and businesses to protect themselves online is through multi-factor authentication (MFA). MFA offers an additional layer of protection …

Eligible customers can now order a free MFA security key | Amazon Web Services

aws.amazon.com

One of the best ways for individuals and businesses to protect themselves online is through multi-factor authentication (MFA). MFA offers an additional layer of protection …

GitHub - aquasecurity/chain-bench: An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.

github.com

An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark. - GitHub - …

Optimizing CI/CD Credential Hygiene - A Comparison of CI/CD Solutions

www.cidersecurity.io

Attackers are always on the lookout to gain access to credentials, which are a critical asset to protect and are widespread throughout the organization.

AWS Security Folks

Brigid Johnson @bjohnso5y

Out with the old and in with the new! We’ve refreshed the IAM best practices. We now have 1⃣4⃣ best practices to guide your identity and access management journey on #AWS 🧵 (1/10) go.aws/3APQW9T

158

59Jul 14 · 9:13 PM

Christophe @christophetd

Stratus Red Team v2.2.0 is out with 3 new attack techniques!

• AWS: launch unusual EC2 instances
• AWS: persistence through IAM Roles Anywhere
• K8s: persistence through the TokenRequest API

github.com/datadog/stratu…

125

38Jul 14 · 12:03 AM

Clint Gibler @clintgibler

📖 CIS Software Supply Chain Security Guide v1.0

100+ recommendations across:

1⃣Source code
2⃣Build pipelines
3⃣Dependencies
4⃣Artifacts
5⃣Deployment

Audit your SDLC based on these recs:
➡️github.com/aquasecurity/c…

H/T @AquaSecTeam, @CISecurity

github.com/aquasecurity/c…

97

39Jul 11 · 9:03 PM

Clint Gibler @clintgibler

📺 MITRE ATT&CKcon 3.0

Slides and videos posted!

25 talks, including a keynote by @selenalarson

H/T @MITREattack

attack.mitre.org/resources/atta…

78

19Jul 13 · 9:00 PM

stephenschmidt @StephenSchmidt

Eligible US-based customers can order their free MFA security key using our new ordering site. See if you're eligible to order: console.aws.amazon.com/securityhub/ho…

#morethanapassword twitter.com/AWSSecurityInf…

AWS Security @AWSSecurityInfo

📣Eligible US-based AWS account holders can receive a free MFA security key.

Learn more and check your eligibility 👉 go.aws/3RnbQTR #morethanapassword #multifactorauth

44

23Jul 11 · 6:20 PM

Aidan W Steele @__steele

I implemented an open-source version of the AWS IAM Roles Anywhere client because I wanted to understand how it works.

I wouldn't suggest using it, but it does let you use private keys in an SSH agent rather than on-disk, which is nice.

1/2

awsteele.com/blog/2022/07/1…

57

7Jul 14 · 7:15 AM

Marco Lancini @lancinimarco

Looking for a quick cheatsheet around #SLSA, explaining threats, levels, requirements, and implementations?

I've just made one on CloudSecDocs.com:

cloudsecdocs.com/devops/pipelin…

49

12Jul 13 · 10:00 PM

Kinnaird McQuade ⛅️🧨 @kmcquade3

“Code is a liability. Code can at best do exactly what you intend it to. Bugs detract from this. You can only lose points through more coding. The more code you own, the more opportunities exist to depart from your intended value.”

Love this quote from @ben11kehoe

Ben Kehoe @ben11kehoe

@benjamin_l_s Obligatory plug for my article on the serverless mindset: ben11kehoe.medium.com/serverless-is-…

37

11Jul 11 · 6:20 PM

Christophe @christophetd

The security research team @datadoghq is launching a dedicated blog:

securitylabs.datadoghq.com/articles/welco…

We have some exciting content coming up shortly (including from the amazing @Frichette_n 👀), make sure this is in your RSS feed!

37

9Jul 11 · 10:50 PM

Scott Piper @0xdabbad00

Interesting to see this still had another issue after @_fel1x had found one issue in the same code: bugs.chromium.org/p/project-zero…
which was a derivative of his finding in Hashicorp Vault googleprojectzero.blogspot.com/2020/10/
and a second look had happened at this code github.com/kubernetes-sig…