Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

Filter by
Sorted by
Tagged with
0 votes
1 answer
26 views

Docker, running programs as Root and AWS

It is well known that running programs inside your docker container as root is bad practice. As far as I can tell, the reason for this is because root on the container is rather similar to root on the ...
user avatar
  • 101
0 votes
1 answer
20 views

AWS Service-To-Service authentication via Identity document

In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
user avatar
  • 1
0 votes
1 answer
29 views

SCP to create security groups in member AWS account

I'm trying to create a SCP to restrict member account users to create/modify security group(s) that have inbound rule for SSH/RDP with Source set as 0.0.0.0 or ::/0. Basically, I want users to SSH ...
user avatar
  • 525
0 votes
1 answer
22 views

what is benefit of using KMS to "encrypt" between two AWS users, instead of just sending directly through AWS?

I am just learning KMS and how granting encrypt/decrypt permissions on KMS keys works, but I don't understand what is the benefit of using KMS to encrypt data to send to another AWS customer, who then ...
user avatar
  • 653
0 votes
0 answers
45 views

Why do I need an IDS/IPS in a serverless cloud environment?

Following this question (Why do we need IDS/IPS if a firewall is present?) from a few years back, I am trying to take this subject to the cloud. Assuming that I have a fully "serverless" AWS ...
user avatar
  • 101
1 vote
1 answer
39 views

Can I escalate my privileges if I have read-write access to IAM service in AWS?

We are trying to convince folks in our company to grant developers full privileges to all services in "dev" account (current policy does not allow developers to create anything in our AWS ...
user avatar
  • 113
0 votes
0 answers
35 views

AWS IAM Access Issue

We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or ...
user avatar
0 votes
0 answers
96 views

Latest AWS Windows Cloud Formation bootstrap binaries are not legit?

It seems the latest version of CloudFormation binaries used on EC2 Windows instances are reported as NOT legit by VirusTotal. Mainly cfn-elect-cmd-leader.exe" and "winhup.exe" https://...
user avatar
1 vote
2 answers
64 views

Securely storing password and encryption key on AWS

I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an ...
user avatar
2 votes
1 answer
36 views

Security Concern Opening Up Azure VM to AWS IPs

We have an IIS webserver hosted in Azure. We want to monitor this server via our cloud SIEM hosted in AWS. To monitor, there is a requirement to open outbound 443, on the VM, to a few hundred AWS ...
user avatar
  • 133
1 vote
1 answer
34 views

Is SSL on AWS RDS in private network necessary

I saw that using SSL on AWS RDS can reduce the performance of the database by over 10%. Let's say that an RDS database is on a private network and only accessed by applications on other private ...
user avatar
  • 13
0 votes
0 answers
28 views

Google Cloud and Private CM on Microsoft Windows and FedRamp compliance for TLS

Is it possible to use Private Certificate Authority based on Microsoft Windows Servers for protection SSL/TLS connections in FedRAMP environment on Google Cloud?
user avatar
0 votes
1 answer
64 views

ec2 instance insecure to allow ssh to any ip address

I have a linux instance deployed on AWS EC2. Sorry for my dumb question, but I'll ask anyways just to be safe. Q1. While creating an instance, I set anyone 0.0.0.0:0 for the ssh. Though, on the next ...
user avatar
0 votes
1 answer
159 views

Should we enable UFW for EC2 (Ubuntu Server) instance with Nginx?

I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal. I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message. It's not a big ...
user avatar
2 votes
0 answers
77 views

All private subdomains found and listed, including those from my home IP

It's been my understanding in the past years that it's not easily possible to find out all the subdomains of a domain (unless these are used publicly, like in hyperlinks, etc), and likewise not easily ...
user avatar
  • 215
1 vote
1 answer
107 views

Where could we get CIS Hardening Scripts for AWS EC2?

CIS has published hardening standards for all operating systems of EC2 in AWS. CIS also provides hardened images as well but they're quite expensive at $130/year/instance. Is there a place where we ...
user avatar
  • 113
0 votes
0 answers
62 views

Need help figuring out what a CloudFront custom origin is

When reviewing cloudfront dist config via the aws cli, I came across a CustomOriginConfig with the id of XXXX. How can I use that id to figure out exactly what that custom origin is for this ...
user avatar
  • 11
3 votes
0 answers
3k views

What does a POST like 0x%5B%5D=somename try to achieve?

We created a default environment on AWS Elastic Beanstalk using their Python "sample app". After some time, the logs show a large number of POST requests with bodies like this: b'0x%5B%5D=...
user avatar
  • 433
0 votes
1 answer
106 views

Purpose of fraudulent AWS SL/TLS certificate request for my domain

I just received an email from AWS re Certificate request for [my personal domain]. This email asked me to approve this request with a link or forward to a AWS email for validation. Needless to say ...
user avatar
2 votes
1 answer
130 views

Not the same password for AWS (root user) and Amazon.com shopping, because that is not secure in my eyes

I use the same email address for the AWS root user and my Amazon shopping account. Unfortunately the password for both parts of Amazon is also the same, when I change the AWS password I automatically ...
user avatar
  • 1,413
1 vote
2 answers
131 views

How to manage Encryption Key for Server Side Encryption in AWS S3

I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows: All the existing data ...
user avatar
2 votes
1 answer
332 views

Are weak cipher suites for TLS1.2 a valid concern?

I have an API hosted on Amazon API Gateway. When running a security scan of it using https://www.ssllabs.com/ it reports back warnings concerning weak cipher suites for TLS 1.2 (see below). Are these ...
user avatar
  • 123
1 vote
3 answers
135 views

Is it more or less secure to use IAM (AWS user management) if you only have one user?

This is an edge case, and as soon as multiple users are accessing the AWS Console in anyway, IAM is the only good option, but what if you only have one user? I've always assumed that if only one ...
user avatar
  • 302
0 votes
0 answers
71 views

Can I process ITAR data in AWS GovCloud?

I need to build a service that shares and processes ITAR data. From my understanding reading ITAR documentation, the data must be end-to-end encrypted, and the private keys must never be stored in ...
user avatar
  • 101
1 vote
0 answers
207 views

AWS KMS CMK compromise

Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
user avatar
0 votes
0 answers
116 views

Nitro Enclave / KMS Equivalent for Google and Azure

In AWS KMS I can set a key policy on a CMK so that it can only be used from within a Nitro Enclave that either has a particular signature or a particular image hash. Is there something similar to this ...
user avatar
  • 215
0 votes
1 answer
720 views

Amazon AWS S3 Unrestricted File Upload

While I was pentesting a web application, I found out that files that are uploaded to the web application are stored in an AWS S3 instance. Based on my experience, when a web application needs to ...
user avatar
0 votes
1 answer
257 views

How do I get a forensic copy of an EC2 server?

Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
user avatar
34 votes
4 answers
10k views

Is serverless code immune to DDoS attacks?

In classic hosting we have a virtual machine with limited resources allocated by hosting provider for running our web application. But with serverless code such as AWS Lambda or Azure Functions, our ...
user avatar
0 votes
0 answers
116 views

A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority

I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS. My public web domain is ...
user avatar
0 votes
0 answers
73 views

Can I Use AWS Cognito to protect external service, not AWS hosted service

I have a requirement to offer an Open ID Connect Identity Provider server. (That is, i have some users with their credentials checked against some data store under my control, and users are using ...
user avatar
  • 101
4 votes
4 answers
431 views

Is it good practice to disable firewall rules for vulnerability scanners?

I've been asked to ensure that our vulnerability scanning tools (like Qualys, Nexpose) are able to reach all of our AWS EC2 instances, on all ports and protocols. Today they are limited by the current ...
user avatar
0 votes
0 answers
66 views

How MySQL keyring_aws plugin stores the master key securely?

From MySQL internal doc, I am presuming that keys of keyring_aws are stored locally after generation. All the mandatory information like master key needed to decrypt table is configured locally using ...
user avatar
0 votes
0 answers
69 views

Configure Spring application deployed in AWS Elastic Beanstalk to use SSL

I deployed successfully Spring application into AWS Elastic Beanstalk which us going to be used as Rest endpoint by Angular app deployed into Cloudfront service. I want to encrypt the communication ...
user avatar
1 vote
1 answer
113 views

AWS Private CM and FedRamp compliance for TLS

Is the use of a private, auto-signed certificate, created and managed by AWS Private CM, and use in internal TLS communication, for endpoints that do not require external verification, and do not have ...
user avatar
0 votes
0 answers
397 views

OpenVPN client suddenly refuses to connect to my self-hosted VPN

It's been working fine for years, but now suddenly I'm getting a strange error. Does anyone know what problem this points to? OpenVPN Connect Version 3.0.2 (598), error logs: [REDACTED IPs] 5/16/2021,...
user avatar
  • 121
1 vote
1 answer
184 views

Can a Man-in-the-Middle-Attack be achieved by adding a cloudfront distribution origin of a domain not owned by me?

Cloudfront supports adding external origins, i.e. domains that are not S3 buckets or ALBs. This led me to wonder whether adding domains that are not owned by the entity as an origin could allow for ...
user avatar
3 votes
1 answer
245 views

AWS credentials seem terribly insecure. Why? [closed]

In my ~/.aws/credentials I have the following: [default] aws_access_key_id = <something> aws_secret_access_key = <something-else> This file has permissions 0600 but doesn't ...
user avatar
  • 335
1 vote
1 answer
234 views

Does AWS store users' passwords without hashing?

I just noticed that AWS provides a service that checks your users' passwords for corporate password rule compliance "periodically": https://docs.aws.amazon.com/config/latest/developerguide/...
user avatar
1 vote
0 answers
70 views

How to provide | revoke access to an AWS machine without going through the AWS console

Assuming if you do via SSH (which is shared among multiple team members), how to manage this from a security perspective or should each user be given a separate SSH key
user avatar
  • 111
1 vote
1 answer
105 views

Does adding a randomized string in S3 file path has equal security to Google Drive shared link

I would like to use an AWS S3 bucket to store my IoT firmware file and allows all of my IoT devices to access it to update the firmware to the latest version. I want that the firmware file in the S3 ...
user avatar
1 vote
3 answers
736 views

Does domain resolve to CDN (Cloudfront) IP and not the actual web-app server?

If a web-app is using cloudfront as CDN, what happens if I ping the domain? Am I pinging the cloudfront endpoint? Or the web-app server? Why is it DNS resolution resolves to different IPs in this case?...
user avatar
  • 11
1 vote
1 answer
239 views

Thunderbird uses AWS: Secure?

In their Privacy Note, Mozilla writes the following: Amazon Web Services: Thunderbird uses Amazon Web Services (AWS) to host its servers and as a content delivery network. Your device’s IP address is ...
user avatar
1 vote
0 answers
67 views

Is there record of a pubilc RDS instance with strong password having been hacked?

I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet However, the instance has a relatively strong ...
user avatar
1 vote
2 answers
223 views

Hacking attemps from unkown source

I'm running a docker container in Kubernetes cluster running in aws, I exposed the container through LoadBalancer service and limited access to it just to my ip address using aws security groups, but ...
user avatar
  • 53
0 votes
2 answers
175 views

Separate SSL certs on CloudFront and Heroku?

I find SSL real confusing, but anyways. For my frontend static website, I host on S3 and distribute using CF. I just use something simple like comodo SSL to generate an SSL cert and then go through ...
user avatar
2 votes
3 answers
142 views

Is using a dedicated IP for AWS dev access secure enough?

I'm about to launch my first ever SaaS product on AWS and am thinking through security. I have my main server, which is obviously public on :80 and :443, and then I have a bunch of other infra that I ...
user avatar
  • 123
1 vote
1 answer
172 views

Are AWS EC2 key-pairs compromised when an EC2 instance is compromised?

Suppose I have multiple EC2 instances deployed with the same key-pair. The key-pair is used for SSH access and general troubleshooting. If one instance is compromised, do I need to be concerned about ...
user avatar
  • 148
0 votes
1 answer
244 views

Isolation AWS resources with multiple subnets vs multiple VPCs

I have AWS resources (e.g. EC2s, RDS instances) that I would like to isolate from each other so that if one is compromised, the potential damage is limited. I am most concerned about data leakage / ...
user avatar
  • 148
0 votes
1 answer
1k views

It's secure to store private keys in AWS Secret Manager?

I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
user avatar

1
2 3 4 5 6