Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
41 views

Protect out SES SMTP details [closed]

We are using SES SMTP with cPanel webmail (Exim) and PHP to send emails. This issue happened today and last week. Currently, We have the credentials in 2 places: 1- Exim configuration. 2- PHP files. ...
Dev's user avatar
  • 1
0 votes
1 answer
52 views

How do AWS "Pod Identities" compare to (OIDC) IRSA?

In Kubernetes clusters, we often wish to provide temporary credentials to the containerised processes running in a particular pod, usually marked by associating the pod with a service account. ...
benjimin's user avatar
  • 175
0 votes
0 answers
66 views

AWS Key stolen out of Github Actions / Secret Store

Do you have an idea how my AWS credentials could be stolen in the following setup: A 4 weeks old GitHub organization with 5 repositories & AWS Account AWS CI User Credentials with Administration ...
user1845948's user avatar
0 votes
0 answers
21 views

Google SAML auth not working through APP tile but works with direct link

We've recently migrated from Okta to Google for work for AWS authentication. Our amazon org authentication is setup through IAM Identity center. It was working flawlessly using Okta but since we ...
JeanneD4RK's user avatar
0 votes
0 answers
88 views

AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment

Let's say we produce IoT devices and want them to access AWS IoT Core. The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
Francesco B.'s user avatar
2 votes
0 answers
113 views

How are companies automatically rotating secrets such as API keys?

We currently rotate AWS-specific secrets via AWS Secrets Manager without much issue. However, we are looking to also rotate secrets e.g. API keys for specific services, but AWS Secrets Manager does ...
Wunderbread's user avatar
0 votes
1 answer
90 views

Why is ip forwarding for a ECS instance being flagged as a vulnerability?

I am very new to this and was asked to address some security patches on various ec2 instances in our AWS account. Mostly this was a matter of using the Security Manager to connect to the instance and ...
Rob D's user avatar
  • 1
0 votes
0 answers
79 views

Risk for a public RDS database on AWS

I have a RDS database on a VPC which is public with a password. I have some lambda functions (that are not in a VPC) that communicates with this database. To be able to do that I had to modify the ...
JVanced's user avatar
3 votes
1 answer
350 views

How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?

Problem Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*. ...
James Nugent's user avatar
0 votes
0 answers
77 views

Is it risky to include .env files in the .zip which is uploaded to Elastic Beanstalk for deployment? If so, what is the risk?

Is it okay to upload .env files containing client ID and client secret to elastic beanstalk? If not, what is the risk involved? How would one access those files?
BigMistake's user avatar
2 votes
1 answer
494 views

Public client or Confidential client: should I generate a client secret?

I've read about this but I don't fully understand how to choose. I have two options: Public client "A native, browser or mobile-device app. Cognito API requests are made from user systems that ...
BigMistake's user avatar
0 votes
1 answer
103 views

Does using Apache/nginx actually improve security of a webapp?

Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the ...
BigMistake's user avatar
1 vote
0 answers
87 views

Prevention of access to user data running on the cloud

I am building a web-based software as a service (SaaS) platform for engineering simulations that run on the cloud, and wish to prevent my access to user data by design. The user designs a 3D geometry (...
Coto TheArcher's user avatar
5 votes
2 answers
205 views

Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers

We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
Brogrammer's user avatar
2 votes
0 answers
116 views

Using API key as public key and IP address as private key to WASM application

I'm trying to offer a service to users that allows them to write Python via pyodide or R code via webR in their browser against my own data. I've been thinking of ways to go about this and I'm curious ...
S3AN556's user avatar
  • 21
1 vote
1 answer
359 views

Explanation of the AWS IAM PassRole vulnerability

Help me understand what the risk in the AWS Privilege Escalation Vulnerabilities article is. I think it is normal that I create an EC2 instance and associate an IAM role as its instance profile, and ...
mon's user avatar
  • 295
6 votes
1 answer
8k views

Understanding ssh-rsa not in PubkeyAcceptedAlgorithms

I am having problem in connecting to an Amazon EC2 Linux instance from an old Mac OS machine running El Capitan. Unfortunately without any possibility to upgrade the OS. Because all the other modern ...
Leonardo's user avatar
  • 163
1 vote
1 answer
2k views

AWS RDS Database access from Github Actions

I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS. The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
Jöcker's user avatar
  • 111
1 vote
1 answer
424 views

Should an AWS Lambda trust-policy be narrowly scoped?

Should trust policies for AWS Lambda be narrowly scoped, and how can this be implemented (e.g. using Terraform)? Using Terraform I ran into a cyclic dependency problem as follows: an AWS Lambda ...
benjimin's user avatar
  • 175
2 votes
0 answers
68 views

AWS sub-accounts to protect against deletion of versioned data in S3

How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
benjimin's user avatar
  • 175
1 vote
1 answer
95 views

Is my Jupyter notebook on EC2 secure?

I have a product I am making available to some users that runs via a Jupyter notebook. I deploy Jupyter inside of a docker container to an EC2 host. Each user gets an instance I'll send to them. For ...
achyrd's user avatar
  • 115
1 vote
1 answer
144 views

Is handling keys with vps without kms secure?

I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the ...
Hejhejhej123's user avatar
0 votes
0 answers
430 views

Why am I able to access EC2 metadata endpoint from within a Docker container running in the EC2

My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether ...
qre0ct's user avatar
  • 1,522
0 votes
1 answer
187 views

Confidential Computing - SQL Server Always Encrypted w/ Secure Enclave - Customer Managed Keys or alternative

I am looking into ways to build a data warehouse that would house confidential data for 1+ clients. The requirement is that our organization can never obtain access to the decrypted data. There would ...
jackie's user avatar
  • 101
0 votes
1 answer
208 views

Understanding AWS/KMS Keyring Encryption, Genkeys and Plaintext Data Keys

I'm reading up on the AWS Encryption SDK (JavaScript flavor but this is the same for Python and Java, and my question is really on the underlying security principles, which are language agnostic). On ...
hotmeatballsoup's user avatar
0 votes
1 answer
1k views

Is using route 53 from AWS sufficient for DDOS protection on DNS level, or do you need to combine it with other AWS products

We have been targeted by DNS DDOS attacks. We have now migrated to AWS Route53 as these DNS servers are more resilient. Is using AWS Route 53 enough to have basic DDOS protection? Or is it necessary ...
MichaelD's user avatar
  • 101
1 vote
1 answer
211 views

Using AWS System Manager Parameter Store SecureString in config file in ec2

On an ec2 box I am running a service that reads vars from a config file. One var's value is stored in AWS System Manager as a SecureString. I want to use that value in the text file securely. I can ...
halfcrud6sad's user avatar
0 votes
1 answer
114 views

e-signature + digital signature aws md5

I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents. My question are: Is MD5 (...
user286122's user avatar
0 votes
1 answer
394 views

After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?

I have a private S3 bucket. I want a user from an external organisation to have access. I have added a user in IAM. How does this external user get notified and how do I share credentials? The secret ...
Architect 's user avatar
0 votes
2 answers
232 views

Does AWS security group block unintentionally exposed ports from Docker?

My typical cloud server hardening includes blocking ports at the UFW level on the server as well as at the AWS security group level. I recently learned that Docker overwrites your IPTables. Given that,...
angryserver's user avatar
0 votes
1 answer
162 views

Is someone trying to attack our API

I created a service with elastic beanstalk in AWS 2 or 3 hours ago. EC2 is in private subnet and load balancer is in public subnet. When I look to logs I saw these requests. What are they?
AuroPick's user avatar
0 votes
1 answer
735 views

What is the intent behind these unknown HTTP Requests into my AWS Web Server?

I know about the usual port sniffers and mass scanners that just pop up on any web server, but this one looks interesting to me. I figured out so far that those requests aren't really an issue for my ...
Flying Thunder's user avatar
0 votes
2 answers
107 views

Would the TCP port of a VPN with access to the VPC be considered as a "Server administration port" in CIS benchmark?

I'm deploying an AWS Infrastructure that should adhere the CIS Benchmark. I'm trying to understand if the TCP port of the VPN server that permits access to the VPC has to be considered as a "...
sgargel's user avatar
  • 111
2 votes
2 answers
191 views

Do CloudFront edges talk to custom origins over open (non-AWS) networks?

Where the custom origin server for an AWS CloudFront distribution is an EC2 instance accessible with a public DNS record, do CloudFront edge locations talk to it over the open Internet — as opposed to ...
Greendrake's user avatar
0 votes
1 answer
143 views

How to know if an Amazon AWS server is safe or not?

I see connections to Amazon AWS servers, and since everyone can register servers on Amazon, how do I know if my PC communicating with a safe Amazon server, or with a server which a hacker registered? ...
kiec00's user avatar
  • 39
1 vote
1 answer
294 views

Can the services inside the VPC be authentication less?

We have a micro-services architecture, where many microservers need to talk to each other for data. These services are inside a VPC. I need to understand if the HTTP APIs of these microservices need ...
Vamsi Pavan Mahesh's user avatar
0 votes
2 answers
265 views

Docker, running programs as Root and AWS

It is well known that running programs inside your docker container as root is bad practice. As far as I can tell, the reason for this is because root on the container is rather similar to root on the ...
sdfgeoff's user avatar
  • 101
0 votes
1 answer
504 views

AWS Service-To-Service authentication via Identity document

In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
anon2328's user avatar
  • 121
0 votes
1 answer
2k views

SCP to create security groups in member AWS account

I'm trying to create a SCP to restrict member account users to create/modify security group(s) that have inbound rule for SSH/RDP with Source set as 0.0.0.0 or ::/0. Basically, I want users to SSH ...
RaJ's user avatar
  • 525
0 votes
1 answer
146 views

what is benefit of using KMS to "encrypt" between two AWS users, instead of just sending directly through AWS?

I am just learning KMS and how granting encrypt/decrypt permissions on KMS keys works, but I don't understand what is the benefit of using KMS to encrypt data to send to another AWS customer, who then ...
Bennett's user avatar
  • 653
1 vote
1 answer
672 views

Why do I need an IDS/IPS in a serverless cloud environment?

Following this question (Why do we need IDS/IPS if a firewall is present?) from a few years back, I am trying to take this subject to the cloud. Assuming that I have a fully "serverless" AWS ...
Nir Levy's user avatar
  • 111
1 vote
1 answer
158 views

Can I escalate my privileges if I have read-write access to IAM service in AWS?

We are trying to convince folks in our company to grant developers full privileges to all services in "dev" account (current policy does not allow developers to create anything in our AWS ...
Kashyap's user avatar
  • 113
0 votes
0 answers
115 views

AWS IAM Access Issue

We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or ...
samtech 2021's user avatar
1 vote
2 answers
123 views

Securely storing password and encryption key on AWS

I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an ...
JavaForAndroid's user avatar
2 votes
2 answers
108 views

Security Concern Opening Up Azure VM to AWS IPs

We have an IIS webserver hosted in Azure. We want to monitor this server via our cloud SIEM hosted in AWS. To monitor, there is a requirement to open outbound 443, on the VM, to a few hundred AWS ...
Nina G's user avatar
  • 133
2 votes
1 answer
432 views

Is SSL on AWS RDS in private network necessary

I saw that using SSL on AWS RDS can reduce the performance of the database by over 10%. Let's say that an RDS database is on a private network and only accessed by applications on other private ...
Florat's user avatar
  • 23
0 votes
1 answer
291 views

ec2 instance insecure to allow ssh to any ip address

I have a linux instance deployed on AWS EC2. Sorry for my dumb question, but I'll ask anyways just to be safe. Q1. While creating an instance, I set anyone 0.0.0.0:0 for the ssh. Though, on the next ...
Nika Kurashvili's user avatar
1 vote
1 answer
2k views

Should we enable UFW for EC2 (Ubuntu Server) instance with Nginx?

I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal. I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message. It's not a big ...
mr_ternary's user avatar
2 votes
0 answers
441 views

All private subdomains found and listed, including those from my home IP

It's been my understanding in the past years that it's not easily possible to find out all the subdomains of a domain (unless these are used publicly, like in hyperlinks, etc), and likewise not easily ...
Nuno's user avatar
  • 215
1 vote
1 answer
1k views

Where could we get CIS Hardening Scripts for AWS EC2?

CIS has published hardening standards for all operating systems of EC2 in AWS. CIS also provides hardened images as well but they're quite expensive at $130/year/instance. Is there a place where we ...
Biju's user avatar
  • 113

1
2 3 4 5 6