Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

0
votes
0answers
58 views

Security Audit on AWS - question on findings

Just wondering about an assessment I'm doing regarding a client's AWS environment. I'm new to AWS to I'm having to learn a lot on the go. I used ScoutSuite and got some findings, specifically: EC2: *...
1
vote
1answer
36 views

How can I encrypt messages sent over AWS PrivateLink?

I am working on a project where I need to send messages to a partner via AWS PrivateLink. Because these messages contain PII, the data needs to be secure. I have been unable to determine from internet ...
1
vote
0answers
25 views

Nmap showing different open ports every few seconds [duplicate]

I'm running Nmap on an Amazon Web Services EC2 instance but between runs just a couple seconds apart, I'm getting new results. Is this normal? I'm seeing open ports then they don't show. I'm running ...
0
votes
1answer
67 views

Windows Server: Import HSM-backed certificate into second server

Scenario: Using Amazon CloudHSM with CloudHSM Windows Client installed and configured. Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider. Submitted ...
0
votes
0answers
13 views

Communicating with things on AWS IoT without certificates problem

Is "IAM" access the only method to gain access AWS? I'm asking because I'm using AWS IoT. With AWS IoT we create things such as devices on AWS IoT Core. However, with IAM access, after creating a "...
0
votes
1answer
44 views

Explanation of the authentication procedure when using signed certificates [duplicate]

I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT. On my device side, I have a device certificate ( deviceCert.crt ) and the device ...
0
votes
0answers
34 views

What is Amazon's GDPR role with Alexa for Business Conferencing?

With respect to GDPR and the Alexa for Business conferencing solution, is Amazon acting in the capacity of a data controller or a data processor, or even a sub-processor? Here's some information on ...
0
votes
0answers
43 views

How to fix AWS security ALAS-2019-1149?

I need to investigate for the security hole ALAS-2019-1149(https://alas.aws.amazon.com/ALAS-2019-1149.html) which is report ed by AWS. I saw in the session "Issue Correction" Run yum update kernel to ...
0
votes
1answer
41 views

Should I take (Pen test) approval from AWS for Fuzz testing my Application API's hosted on AWS? [closed]

I wanted to Fuzz Tests my API's on my own stack which are hosted on AWS environment (Have used lambdas and API gateway) There are mostly GET APIs and only one PUT API.My requirement is to Fuzz Test ...
4
votes
1answer
66 views

Is there any harm to writing a short plain-text string to authorized_keys?

I have a CFN template where I'm seeding an authorized key for testing via paramaters, through a build server. If this value is not provided by the build job, it defaults to a short, plain text string, ...
0
votes
0answers
74 views

Is my server under some kind of reconnaisance/attack?

Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server. I don't have those ...
1
vote
0answers
76 views

Using Google Authentication with Lambda@Edge and S3 Static Sites

I am looking to set up authentication on an S3 hosted static site. The configuration is: S3 bucket configured to allow access via cloudfront AWS Cloudfront distribution with HTTPS configured and a ...
1
vote
2answers
138 views

Penetration Testing authorization from AWS

We have a few web applications newly hosted on AWS. Before we run an automated pentest on the our Application URL using Netsparker, we had always e-mailed Amazon and requested authorization for the ...
0
votes
2answers
58 views

Is AWS subnets enough for segregation of networks? or do we need VPC?

Is AWS subnets enough for segregation of networks with the all security groups? or do we need VPC to really issolate two application from each other?
0
votes
0answers
33 views

Anyway of finding connected devices on a vpn router from the VPN server itself?

I've setup my own OpenVpn server on AWS using an EC2 instance and I have a router with OpenWRT configured to connect to the VPN Server. Now, I want to have some EC2 running network scans such as NMAP ...
2
votes
1answer
43 views

What is the impact of leaving disabled root key on AWS instance?

I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance. When asked to remove the root key, he said it's disabled now so what's the ...
2
votes
1answer
32 views

What attack vectors does AWS SSE-S3 help mitigate?

Reading into the various SSE options on S3, I'm can't understand the following: What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against? I can only think of ...
3
votes
0answers
26 views

AWS SSM Agent protection

Our company is moving to the AWS cloud recently, and AWS relies a lot on the SSM agent, it is also opensource. ( https://github.com/aws/amazon-ssm-agent ) From my understanding, this agent is not ...
0
votes
2answers
79 views

AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation

I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture. We are using components such as AWS Lambda, AWS ...
1
vote
1answer
79 views

How secure is SSL private key in AWS ELB service?

We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
0
votes
1answer
23 views

Best practice for config files for ec2 instances

I am building a lamp server ec2 image for a project we are doing. These images will be in an autoscaling group and on startup will be running startup script. THere are some config files that have ...
1
vote
1answer
53 views

How secure is it to use port forwarding for VNC?

I am following this tutorial that explains how to use a VNC client to logon to an Amazon EC2 instance. After a few steps, it asks me to login to the instance using port forwarding using this command: ...
0
votes
0answers
55 views

What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?

When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2. I have gone ...
1
vote
1answer
107 views

Getting scanned on AWS Elastic BeanStalk

As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
1
vote
0answers
35 views

Are there any additional security precautions I can or should take with my service?

Suppose I'm building a service to store all the secure or sensitive information that my other applications use. Think passwords, or private SSH keys. Under the old programming paradigm of 'do one ...
0
votes
1answer
55 views

unable to verify AWS EC2 Instance Identity Document with libressl

I'm trying to follow the steps here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html to verify an instance identity document, and I'm getting success when I ...
2
votes
1answer
78 views

envelope encryption (using KMS) vs ECDH

at work I have implemented basic envelope encryption when sending messages to a client. I am using AWS KMS and have a master key there. I get a data key, encrypt the message with AES-GCM and send the ...
0
votes
1answer
134 views

AWS Load Balancer Response Header Apache Server Disclosure

I have a node.js environment deployed using AWS Elastic Beanstalk on an Apache server. I have run a PCI scan on the environment and I'm getting 2 failures: Apache ServerTokens Information Disclosure ...
1
vote
1answer
286 views

Is this the correct way to use AWS Cognito?

I am doing the following in my React/Node App: Using the User Pools for a Cognito App that I have created Calling the /login endpoint with response_type=token in my React App Once I receive the JWT ...
0
votes
0answers
56 views

Meltdown checker says AWS and Rackspace is vulnerable - Why?

Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with 7 of 8 variants OK (the failed one is apparently ...
1
vote
0answers
18 views

What is needed to secure a docker container that's running on nodes in an AWS Private Subnet with internet access only via NAT?

I know securing a container is a big deal and a lot is needed to be done to secure a default container configuration. But having it in a private subnet should take care of a lots of risks. So what ...
3
votes
1answer
67 views

AWS Flowlog for Private Subnet Showing Routable IP's

When reviewing Flowlogs for a host on a private subnet in an AWS VPC that routable IP addresses are being rejected. How is that possible? I expect IP addresses from the private subnet could be ...
0
votes
1answer
56 views

How to fix AWS security hole ALAS-2018-1045?

I am researching about the security hole CVE-2018-12020 and learned that you need to update to min version 2.2.8 to fix the issue. I need to fix this for my EC2. I read information from this offical ...
0
votes
1answer
58 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
2
votes
1answer
329 views

Amazon EC2 Abuse Report

My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance. The email states: We observed machines under your control ...
2
votes
2answers
139 views

How are stateless firewalls useful in public cloud platforms?

I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
0
votes
1answer
56 views

Is AWS Elastic Beanstalk traffic from load balancer to backend EC2 instances secure?

AWS Elastic Beanstalk service routes traffic back to its EC2 instances through HTTP by default. I know this can be configured to achieve end to end encryption by adding SSL encryption from the load ...
2
votes
2answers
157 views

Should I have an SSH bastion?

I am using AWS. I need to connect with a local SSH client to Linux EC2/ECS instances. I also need to connect with a local PostgreSQL client to RDS instances. There are tutorials for creating SSH ...
1
vote
1answer
104 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
0
votes
1answer
43 views

How does Amazon Web Services generate SSH Keys?

How does Amazon Web Services generate SSH Keys? Does it generate the key pair completely in the browser or does it generate the keys in the server and send us the private key over HTTPS? I tried to ...
2
votes
1answer
168 views

Keeping AWS account ID secret

Must my AWS account ID be kept secret? Can anything at all be done using just the AWS account ID? From the AWS documentation: The AWS account ID is a 12-digit number, such as 123456789012, that ...
1
vote
1answer
63 views

How is AWS app identity verified?

So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
3
votes
5answers
513 views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
0
votes
1answer
282 views

Reasons to transition Kerberos secured web applications to OAuth2/OpenId

We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) . ...
0
votes
0answers
18 views

Is the example VPCAccess Lambda Policy template safe?

Following the policy templates provided by AWS documentation yields a policy document (minus other statements) like such: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", ...
1
vote
0answers
33 views

Securely retrieving and exposing configuration within Docker

It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
0
votes
1answer
67 views

What are the risks of placing Amazon Resource Names (ARNs) in VCS repositories?

Amazon Resource Names (ARNs) uniquely identify AWS resources. Amazon requires an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational ...
7
votes
2answers
133 views

Do Transient, Volatile Servers Require Antivirus Scanners?

We are often asked whether we install antivirus software on our servers, specifically the kind of signature-based scanners that run on a schedule. Client security questionnaires and ISMSes often ...
0
votes
1answer
834 views

Amazon AWS KMS - Concept of signing in general and with JWT

Looking into Amazon AWS KMS (Key Management System). Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/...
5
votes
1answer
145 views

Dual - control (two man access) to AWS root logins?

I've been going around a few threads / questions here but none of them actually talked about concrete implementation of two-man authorization methods. I've read reasonable amount of ideas and "why"s ...