Lex NevaDec 26
2
Monday January, 2023
In a nutshell
Happy New Year, fellow AWS security professionals! As we kick off a new year, let's resolve to stay vigilant and keep our cloud infrastructure secure. From implementing proper identity and access management to regularly reviewing and updating security policies, let's make this year the safest one yet for our organization. Here's to a happy and secure new year!
📢 MAMIP (Monitor AWS Managed IAM Policies)
Policies changed since last week:
SRE Weekly Issue #353
Amazon EMR - 1 new methods
Dec 29
Added GetClusterSessionCredentials API to allow Amazon SageMaker Studio to connect to EMR on EC2 clusters with runtime roles and AWS Lake Formation-based access control for Apache Spark, Apache Hive, and Presto queries.
AWS Secrets Manager - 2 updated methods
Dec 29
Added owning service filter, include planned deletion flag, and next rotation date response parameter in ListSecrets.
Amazon ElastiCache - 15 updated methods
Dec 28
This release allows you to modify the encryption in transit setting, for existing Redis clusters. You can now change the TLS configuration of your Redis clusters without the need to re-build or re-provision the clusters or impact application availability.
AWS Network Firewall - 3 updated methods
Dec 28
AWS Network Firewall now provides status messages for firewalls to help you troubleshoot when your endpoint fails.
iotroborunner: 1 removed resource, 1 removed condition
Dec 31
1 removed resource: TaggingResource; 1 removed condition: iotroborunner:TaggingResourceTagKey (Filters access by the metadata tag name)
autoscaling: 1 removed condition
Dec 31
1 removed condition: autoscaling:TrafficSourceIdentifiers (Filters access based on the identifiers of the traffic sources)
connect: 1 new action
Dec 31
1 new action: UpdateParticipantRoleConfig (Grants permission to update participant role configurations associated with a contact)
Blog | Cloud Cred Harvesting Campaign - Grinch Edition
The Grinch targets Jupyter this Christmas with a cloud cred harvesting campaign.
Nick Frichette - @frichetten@fosstodon.org Never forget that there are a ton of applications which run arbitrary code as a feature. Jupiter Notebooks are a great example. As an attacker, if yo…
Scott Piper RT @TekDefense: If you are running a public facing jupyter notebook, especially in AWS, heads up: permiso.io/blog/s/christm…
Matt Fuller @matthewdfuller
Security vendor: "You should absolutely be defining your infrastructure in code; it's a security best practice."
Also security vendor: "So to configure our product, just log in to our UI and follow these 85 point-and-click steps."
47
3Dec 26 · 5:04 PM
Ian Mckay @iann0036
New year, new #AWS project! ⌨️☁️
I loved the KMS external key stores announcement so I made a mock external key manager using APIGW, Lambda and DDB to learn how it works and mess with keying material.
You can deploy this yourself by installing from github.com/iann0036/toyxks
392Jan 01 · 5:35 AM
Aidan W Steele @__steele
I used to think this too. It's uncouth to talk about money, but having a software engineering degree opens up life-changing opportunities for Australians willing to work in the USA. It can literally make you more than ONE MILLION DOLLARS better off in four years.
Jarred Sumner @jarredsumner
college doesn’t matter
334Dec 29 · 8:43 AM Aidan W Steele @__steele
You have got to be shitting me. Are these abbreviations both really used in the infosec industry?
332Dec 28 · 11:45 PM
Victor Grenu @zoph
Last week, I reported a public bucket at a French bank, filled with about 16GB of data, with nothing noteworthy except static assets. They gave me a credit of $10 for the report. Security for living, I guess :)
283Dec 27 · 9:46 PM
Colm MacCárthaigh @colmmacc
7 years in a row (after fixing it for just two years) ... Google continues to be an absolute mess of "organizing the world's information" with lyrics. This year they credit Rod Stewart for Auld Lang Syne. Previous years include Kenny G and Billy Joel.
Colm MacCárthaigh @colmmacc
6 years now and the Google lyrics team continue to get the basics woefully wrong. They're still falsely attributing long out of copyright Robert Byrne's "Auld Lang Syne" to Dougie MacClean, but now also Theodore Shapiro. I've now submitted 5 corrections, to no avail.
240Dec 28 · 4:40 PM
Abby Fuller @abbyfuller
if you're in the seattle area, my friend colleen (wedding florist! flower farmer! event planner!) is doing a monthly bouquet club this year from april to october 💐
do every month, pick a few of the months. get pretty, locally-grown flowers.
diademflowers.com/flower-shop/p/…
193Dec 26 · 9:24 PM Nick Frichette - @frichetten@fosstodon.org @Frichette_n
It’s been an amazing year for Datadog Security Labs! We’ve released a number of open source tools, shared the results of our research projects. Be sure to subscribe to our RSS feed, we have more cloud vulnerabilities to be released soon :)
securitylabs.datadoghq.com/articles/secur…
180Dec 30 · 4:47 PM
Clint Gibler @clintgibler
I'm stoked to be speaking at @wiz_io's CloudSec 360!
Hope to see you there 👇
Wiz @wiz_io
Check this out — tldrsec.com creator @clintgibler has been added to the CloudSec 360 lineup!
Join to learn how to identify issues before production, build automation into your processes and scale your security into the future 🚀
171Dec 29 · 7:38 PM Colm MacCárthaigh @colmmacc
Today just isn't the same without a Chaos Communication Congress. So many great talks and such a perfect week for soaking in the mind-blowing breaks and exploits. Hoping for its return! twitter.com/i/web/status/1…
171Dec 27 · 5:14 PM
Whats the point of IPv6 native subsets if they don't support auto-scaling target groups?
Anyone else know how to get around target groups not supporting IPv6 ec2 instance targets? They only support hardcoded IPv6 addresses, which doesn't really work with EC2 auto scaling and load balancing.
https://github.com/aws/containers-roadmap/issues/1653
" IPv6 target groups only support IP type targets."
Kind of posting this for visibility too. …
Is fargate the right choice for my apps?
With my company we are developing several web applications.
We are using fargate clusters to run our applications backends (usually laravel apps).
We are using a load balancer to route the traffic to the different containers and the frontends are served by cloudfront.
My question is: are fargate clusters the …
AWS IP Ranges update for 2022-12-16 08:13:06
Changed by +768
Added 52.219.220.0/23
Added 52.95.191.0/24
Added 52.219.220.0/23
Added 52.95.191.0/24
AWS IP Ranges update for 2022-12-16 14:03:09
No changes to IPs
- 🖊️ This digest was forwarded to you? Subscribe here
- 📢 Promote your content with sponsorship
- 💌 Want to suggest new content: contact me or reply to this email
