Lex NevaNov 21
21
Monday November, 2022
In a nutshell
This week, two AWS Managed Policies were deprecated: AWSCodePipelineFullAccess and ReadOnlyAccess. If you want to follow MAMIP Bot, there is a new option with the Mastodon Account, similar to the Twitter version but without the boring Elon...
📢 MAMIP (Monitor AWS Managed IAM Policies)
Policies changed since last week:
- AWSSystemsManagerForSAPFullAccess
- AWSSystemsManagerForSAPReadOnlyAccess
- AWSXrayReadOnlyAccess
- AmazonAthenaFullAccess
- AmazonEBSCSIDriverPolicy
- AmazonInspector2ServiceRolePolicy
- AmazonMWAAServiceRolePolicy
- AmazonOpenSearchIngestionServiceRolePolicy
- FMSServiceRolePolicy
- SecurityAudit
[...]
SRE Weekly Issue #348
[tl;dr sec] #159 - Twitter vs Mastodon, GitHub Attack Trees
Clint at tl;dr secNov 17
AWS Amplify - 5 updated methods
Nov 17
Adds a new value (WEB_COMPUTE) to the Platform enum that allows customers to create Amplify Apps with Server-Side Rendering support.
Amazon Appflow - 4 updated methods
Nov 17
AppFlow simplifies the preparation and cataloging of SaaS data into the AWS Glue Data Catalog where your data can be discovered and accessed by AWS analytics and ML services. AppFlow now also supports data field partitioning and file size optimization to improve query performance and reduce cost.
AWS AppSync - 1 new 10 updated methods
Nov 17
This release introduces the APPSYNC_JS runtime, and adds support for JavaScript in AppSync functions and AppSync pipeline resolvers.
AWS Database Migration Service - 9 updated methods
Nov 17
Adds support for Internet Protocol Version 6 (IPv6) on DMS Replication Instances
Considerations for security operations in the cloud
Stuart GreggNov 18
Cybersecurity teams are often made up of different functions. Typically, these can include Governance, Risk & Compliance (GRC), Security Architecture, Assurance, and Security Operations, to name a few. Each function has its own specific tasks, but works towards a common goal—to partner with the rest of the business and help …
AWS Security Profile: Jonathan “Koz” Kozolchyk, GM of Certificate Services
Roger ParkNov 18
In the AWS Security Profile series, we interview AWS thought leaders who help keep our customers safe and secure. This interview features Jonathan “Koz” Kozolchyk, GM of Certificate Services, PKI Systems. Koz shares his insights on the current certificate landscape, his career at Amazon and within the security space, what …
AWS Security Profile: Reef D’Souza, Principal Solutions Architect
Maddie BaconNov 17
In the weeks leading up to AWS re:invent 2022, I’ll share conversations I’ve had with some of the humans who work in AWS Security who will be presenting at the conference, and get a sneak peek at their work and sessions. In this profile, I interviewed Reef D’Souza, Principal Solutions …
Fall 2022 SOC reports now available with 154 services in scope
Andrew NajjarNov 17
At Amazon Web Services (AWS), we’re committed to providing customers with continued assurance over the security, availability, and confidentiality of the AWS control environment. We’re proud to deliver the Fall 2022 System and Organizational Controls (SOC) 1, 2, and 3 reports, which cover April 1–September 30, 2022, to support our …
elasticache: 1 new action, 1 new condition | 2 updated actions, 1 updated resource
Nov 19
1 new action: Connect (Allows an IAM user or role to connect as a specified EliastCache user to a node in a replication group); 1 new condition: elasticache:UserAuthenticationMode (Filters access by the UserAuthenticationMode parameter in the request); 2 updated actions: CreateUser (conditions), ModifyUser (conditions); 1 updated resource: user (conditions)
iottwinmaker: 3 new actions | 1 updated condition
Nov 19
3 new actions: ExecuteQuery (Grants permission to execute query), GetPricingPlan (Grants permission to get pricing plan), UpdatePricingPlan (Grants permission to update pricing plan); 1 updated condition: aws:TagKeys (type)
Finding malicious PyPI packages through static code analysis: Meet GuardDog | Datadog Security Labs
GuardDog is an open-source tool to identify malicious PyPI packages through source code and metadata analysis
Clint Gibler 🆕 Tool: GuardDog Finding malicious PyPi packages with Semgrep + package metadata Heuristics used: github.com/DataDog/guardd… 140+ malicious packag…
Christophe Tafani-Dereeper Just released a new tool: GuardDog, identify malicious PyPI packages with Semgrep and package metadata analysis securitylabs.datadoghq.com/articles/…
rami RT @NickSDavis: Finding malicious PyPI packages through static code analysis: Meet GuardDog securitylabs.datadoghq.com/articles/guard…
Stealing passwords from infosec Mastodon - without bypassing CSP
The story of how I could steal credentials on Infosec Mastodon with a HTML injection vulnerability, without needing to bypass CSP. Everybody on our Twitter …
The Security Design of the AWS Nitro System
Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides secure, resizable compute capacity in the cloud. It is designed to make web-scale …
Teri Radichel #cybersecurity #cloudsecurity To read. I hope this answers some of the questions in my latest blog series. docs.aws.amazon.com/whitepapers/la…
Colm MacCárthaigh A new AWS whitepaper covering Nitro - "The Security Design of the AWS Nitro System". Super interesting deep dive into virtualization and the AWS app…
GitHub - DataDog/guarddog: GuardDog is a CLI tool to Identify malicious PyPI packages
:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI packages - GitHub - DataDog/guarddog: GuardDog is a CLI tool to Identify malicious PyPI …
Clint Gibler 🆕 Tool: GuardDog Finding malicious PyPi packages with Semgrep + package metadata Heuristics used: github.com/DataDog/guardd… 140+ malicious packag…
Christophe Tafani-Dereeper Just released a new tool: GuardDog, identify malicious PyPI packages with Semgrep and package metadata analysis securitylabs.datadoghq.com/articles/…
Colm MacCárthaigh @colmmacc
A new AWS whitepaper covering Nitro -
"The Security Design of the AWS Nitro System". Super interesting deep dive into virtualization and the AWS approach to security.
HTML: docs.aws.amazon.com/whitepapers/la…
PDF: docs.aws.amazon.com/pdfs/whitepape…
451
133Nov 18 · 4:50 PM Colm MacCárthaigh @colmmacc
+1 to this. I have several times thrown well-meaning but nevertheless interrupting high-ranking executives off of incident calls. Got positive credit for this in promotions! At AWS, we give executives their own call focused on customer communication and I love the separation.
Yvonne Lam @yvonnezlam
CEOs, hell. I have neither forgiven nor forgotten some of the non-contributing managers/ICs in the room during incidents.
32124Nov 19 · 6:44 PM
Abby Fuller @abbyfuller
I’m sorry but I don’t want to talk to people enough to put the work into mastodon
18010Nov 19 · 3:44 AM
Brigid Johnson @bjohnso5y
🗝️ 🗝️ Multiple MFAs for root account is here! One of our top customer asks 🥳 🔐
AWS Identity @AWSIdentity
Configuring MFA is an important step in strengthening your security posture. Starting today, you can add multiple MFA devices to AWS root account and IAM users 🔑 #EnableMFA go.aws/3hPLf4v
13329Nov 17 · 1:19 AM Christophe Tafani-Dereeper @christophetd
Just released a new tool: GuardDog, identify malicious PyPI packages with Semgrep and package metadata analysis
securitylabs.datadoghq.com/articles/guard…
github.com/datadog/guardd…
Bonus: a corpus of 140+ actual malicious packages we found in the wild
github.com/DataDog/securi…
10742Nov 15 · 4:57 PM Clint Gibler @clintgibler
🔎 s3crets_scanner
A tool to find secrets in public S3 buckets
1. Lists public buckets in an account
2. Lists textual or sensitive files (e.g. `.p12`, `.pgp`, etc.)
3. Downloads and scans files using truffleHog3
github.com/Eilonh/s3crets…
8835Nov 18 · 5:00 PM
Victor Grenu @zoph
I've just been fired from @Twitter after telling @elonmusk why AWS IAM Users are still relevant nowadays. 🫡
901Nov 16 · 4:54 PM
Ian Mckay @iann0036
Clearly the best pre:Invent announcement. Also a candidate for best of the year, period. 🎉
AWS Identity @AWSIdentity
Configuring MFA is an important step in strengthening your security posture. Starting today, you can add multiple MFA devices to AWS root account and IAM users 🔑 #EnableMFA go.aws/3hPLf4v
482Nov 17 · 1:16 AM
Brad Geesaman @bradgeesaman
All he had to do as CEO was “literally nothing”, and we’d all have had a better outcome here. I think most could safely say “I could do that!” and be absolutely correct.
344Nov 16 · 3:00 PM Clint Gibler @clintgibler
🗡️ SLSA dip — At the Source of the problem!
Red & blue team strategies for attacking GitHub
Attack trees for 3 three malicious goals:
* Submit malicious source code
* Delete source
* Push a release tag pointing to vulnerable commit
By @francoisproulx
medium.com/boostsecurity/…
268Nov 17 · 12:15 AM
Without saying "it's scalable", please convince me that a serverless architecture is worth it
Hi there –
I have many years of experience developing traditional, serverful web apps.
About six months ago, I made the leap to serverless development (in Python, using AWS Lambda and related services).
I see the advantages in terms of scalability. And scalability is obviously a valid concern.
But everything …
- 🖊️ This digest was forwarded to you? Subscribe here
- 📢 Promote your content with sponsorship
- 💌 Want to suggest new content: contact me or reply to this email
