Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

2
votes
1answer
10 views

What attack vectors does AWS SSE-S3 help mitigate?

Reading into the various SSE options on S3, I'm can't understand the following: What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against? I can only think of ...
0
votes
0answers
10 views

AWS SSM Agent protection

Our company is moving to the AWS cloud recently, and AWS relies a lot on the SSM agent, it is also opensource. ( https://github.com/aws/amazon-ssm-agent ) From my understanding, this agent is not ...
0
votes
2answers
31 views

AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation

I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture. We are using components such as AWS Lambda, AWS ...
1
vote
1answer
42 views

How secure is SSL private key in AWS ELB service?

We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
0
votes
1answer
20 views

Best practice for config files for ec2 instances

I am building a lamp server ec2 image for a project we are doing. These images will be in an autoscaling group and on startup will be running startup script. THere are some config files that have ...
1
vote
1answer
47 views

How secure is it to use port forwarding for VNC?

I am following this tutorial that explains how to use a VNC client to logon to an Amazon EC2 instance. After a few steps, it asks me to login to the instance using port forwarding using this command: ...
0
votes
0answers
52 views

What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?

When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2. I have gone ...
1
vote
0answers
41 views

Getting scanned on AWS Elastic BeanStalk

As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
1
vote
0answers
33 views

Are there any additional security precautions I can or should take with my service?

Suppose I'm building a service to store all the secure or sensitive information that my other applications use. Think passwords, or private SSH keys. Under the old programming paradigm of 'do one ...
0
votes
1answer
31 views

unable to verify AWS EC2 Instance Identity Document with libressl

I'm trying to follow the steps here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html to verify an instance identity document, and I'm getting success when I ...
2
votes
1answer
40 views

envelope encryption (using KMS) vs ECDH

at work I have implemented basic envelope encryption when sending messages to a client. I am using AWS KMS and have a master key there. I get a data key, encrypt the message with AES-GCM and send the ...
0
votes
1answer
65 views

AWS Load Balancer Response Header Apache Server Disclosure

I have a node.js environment deployed using AWS Elastic Beanstalk on an Apache server. I have run a PCI scan on the environment and I'm getting 2 failures: Apache ServerTokens Information Disclosure ...
1
vote
1answer
105 views

Is this the correct way to use AWS Cognito?

I am doing the following in my React/Node App: Using the User Pools for a Cognito App that I have created Calling the /login endpoint with response_type=token in my React App Once I receive the JWT ...
0
votes
0answers
54 views

Meltdown checker says AWS and Rackspace is vulnerable - Why?

Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with 7 of 8 variants OK (the failed one is apparently ...
0
votes
0answers
48 views

Why trust AWS S3 with SSE-C?

Referring to Protecting Data Using Server-Side Encryption with Customer-Provided Encryption Keys (SSE-C): I was wondering why I should believe that AWS only keeps a salted hash of the encryption key ...
1
vote
0answers
17 views

What is needed to secure a docker container that's running on nodes in an AWS Private Subnet with internet access only via NAT?

I know securing a container is a big deal and a lot is needed to be done to secure a default container configuration. But having it in a private subnet should take care of a lots of risks. So what ...
3
votes
1answer
59 views

AWS Flowlog for Private Subnet Showing Routable IP's

When reviewing Flowlogs for a host on a private subnet in an AWS VPC that routable IP addresses are being rejected. How is that possible? I expect IP addresses from the private subnet could be ...
0
votes
1answer
48 views

How to fix AWS security hole ALAS-2018-1045?

I am researching about the security hole CVE-2018-12020 and learned that you need to update to min version 2.2.8 to fix the issue. I need to fix this for my EC2. I read information from this offical ...
0
votes
1answer
44 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
2
votes
1answer
251 views

Amazon EC2 Abuse Report

My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance. The email states: We observed machines under your control ...
2
votes
2answers
114 views

How are stateless firewalls useful in public cloud platforms?

I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
0
votes
1answer
42 views

Is AWS Elastic Beanstalk traffic from load balancer to backend EC2 instances secure?

AWS Elastic Beanstalk service routes traffic back to its EC2 instances through HTTP by default. I know this can be configured to achieve end to end encryption by adding SSL encryption from the load ...
2
votes
2answers
134 views

Should I have an SSH bastion?

I am using AWS. I need to connect with a local SSH client to Linux EC2/ECS instances. I also need to connect with a local PostgreSQL client to RDS instances. There are tutorials for creating SSH ...
1
vote
1answer
102 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
0
votes
1answer
42 views

How does Amazon Web Services generate SSH Keys?

How does Amazon Web Services generate SSH Keys? Does it generate the key pair completely in the browser or does it generate the keys in the server and send us the private key over HTTPS? I tried to ...
2
votes
1answer
92 views

Keeping AWS account ID secret

Must my AWS account ID be kept secret? Can anything at all be done using just the AWS account ID? From the AWS documentation: The AWS account ID is a 12-digit number, such as 123456789012, that ...
1
vote
1answer
57 views

How is AWS app identity verified?

So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
3
votes
5answers
345 views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
0
votes
1answer
211 views

Reasons to transition Kerberos secured web applications to OAuth2/OpenId

We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) . ...
0
votes
0answers
18 views

Is the example VPCAccess Lambda Policy template safe?

Following the policy templates provided by AWS documentation yields a policy document (minus other statements) like such: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", ...
1
vote
0answers
14 views

Securely retrieving and exposing configuration within Docker

It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
0
votes
1answer
51 views

What are the risks of placing Amazon Resource Names (ARNs) in VCS repositories?

Amazon Resource Names (ARNs) uniquely identify AWS resources. Amazon requires an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational ...
7
votes
2answers
124 views

Do Transient, Volatile Servers Require Antivirus Scanners?

We are often asked whether we install antivirus software on our servers, specifically the kind of signature-based scanners that run on a schedule. Client security questionnaires and ISMSes often ...
0
votes
1answer
565 views

Amazon AWS KMS - Concept of signing in general and with JWT

Looking into Amazon AWS KMS (Key Management System). Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/...
5
votes
1answer
114 views

Dual - control (two man access) to AWS root logins?

I've been going around a few threads / questions here but none of them actually talked about concrete implementation of two-man authorization methods. I've read reasonable amount of ideas and "why"s ...
5
votes
2answers
428 views

Is an AWS “Access Key ID” a secret?

AWS's "Secret Key" is (obviously) a secret, but should an "Access Key" alone (without the corresponding secret key) be considered a secret too?
2
votes
1answer
65 views

Controlling windows server on Amazon Web Services

Our site is ISO-27001 compliant. As part of the compliance we were advised not to use RDP to connect to the server, but rather to choose a cloud server which provides a web-interface. Our current ...
0
votes
0answers
77 views

Mostly offline CA HSM

I am looking at deploying some PKIs for a couple different clients, some big and some small. For cost savings (and other reasons) we are contemplating hosting one or more of the issuing CAs in AWS ...
0
votes
0answers
29 views

Security of unlocked, all Protocol/Port disabled, Windows AWS server

I have a AWS hosted EC2 Windows 2016 Server instance. I need to run some GUI automation (even when user is not connected via RDP) on it. This is what I do : Enabled RDP|TCP Incoming/Outgoing from my ...
0
votes
1answer
237 views

Risk of man in the middle attack on AWS S3 due to wildcard SSL certs

I see that using AWS S3 with https, it comes with a wildcard SSL cert. Does that mean man-in-the-middle attack is possible by DNS/network rogue and redirect users into another S3 link (having the ...
0
votes
1answer
110 views

Is It Possible to Implement Rule-Based Access Control on Amazon Web Services?

I've gone through a few security tutorials on AWS and noted that each tutorial focused on role-based access control only. Has anyone used rule-based access control on AWS? If so, could you point me ...
1
vote
0answers
175 views

GDPR compliance in Amazon AWS

Anybody has a nice checklist/todo list to achieve GDPR compliance in Amazon AWS environments? Want to use dev-sec.io checklists, OWASP for web app, AWS Trusted Advisor. Anything else to include/...
0
votes
2answers
113 views

what would happen if someone got their hands on my aws_access_key_id and aws_secret_access_key?

What would happen if somebody gets their hands on AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY? Does this somehow compromise my AWS account? or my buckets or whatever that might be? I just want to ...
0
votes
1answer
96 views

Database logs have multiple “Logon Login failed for user” from different IPs

Background: I have an SQL Server database running on Amazon RDS The AWS dashboard has a section for logs and whenever I check the logs I see the following: 2018-04-27 06:10:26.00 Logon Error: 18456,...
1
vote
0answers
147 views

How is SSL encryption maintained between AWS CloudFront and EC2?

So I recently set up an API on an AWS EC2 instance. To be able to serve responses over HTTPS I used Route 53 to redirect my custom domain to a CloudFront distribution which points to the EC2 instance. ...
0
votes
1answer
418 views

Detect and Scan Open Ports

I am trying to understand two questions - I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
0
votes
0answers
66 views

Reference PHI data with a none HIPAA compliance storage

We store PHI data in AWS DynamoDB, we store connected non PHI in AWS Neptune. We will reference this through a user id, this will generated at user creation, the id is time based hash. Is this a ...
1
vote
1answer
252 views

2048 bit SSH RSA public key vs AWS KMS-encrypted text in source control

I'm trying to work out how acceptable it is to commit KMS-encrypted API keys to source control. It is (I believe) often deemed acceptable to commit public keys to source control. So, to try to compare ...
0
votes
1answer
71 views

Certificate SAN Disclosure. How harmful can it be?

My daily job duties brought me (by mistake) to the following IP: 52.63.96.32 It appears the registrar has signed with a single certificate a "lot" of domain. https://www.shodan.io/host/52.63.96.32 ...
0
votes
1answer
53 views

Inbound Ip Visited “localhost” wordpress stack on AWS

i'm testing a webserver on an aws EC2 instance, it has a wordpress stack on it. The domain is configured properly, public static(elastic ip) redirected to main domain as well as the aws public dns. So ...