Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

Is it OK to use HTTP for internal communication between two micro-services deployed on AWS ECS fargate?

I have micro services deployed as AWS ECS Fargate containers. For internal communication they are using service discovery end point. In my opinion, it is OK to use HTTP for internal communication. ...
0
votes
1answer
33 views

TLS certificate - How to assign a CN name for an EC2?

AWS console(EC2 dashboard) shows public DNS name as ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com for an EC2 instance. But the same AWS EC2 has a different DNS name (shown below): $ hostname -...
1
vote
0answers
39 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
1
vote
2answers
48 views

Serverless Apps Authenticate Users After Page Load - Flaw?

Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn't sent from the user's browser, the only content delivered to the user is a ...
22
votes
4answers
5k views

More than three domains hosted on the same IP address

Not on purpose I did a reverse IP address look up on my site, and it shows that there are three other websites hosted on my server, and now I'm worried. My web is arturofm.com, and here is the lookup:...
1
vote
0answers
23 views

Recomendation for automated rotation of a JSON keyring? [closed]

I have a Sailsjs app that is configured to encrypt model attributes with sensitive information. This seems to use bcrypt, under the hood and leverages a JSON keyring in the configuration (...
1
vote
1answer
43 views

Is encryption/decryption done in the cloud when using CMK keys?

I am trying to understand how AWS KMS works, and there is one thing I am still not completely sure of: when using CMKs, so no Data Keys, no envelop encryption, does the encryption take place in the ...
2
votes
0answers
52 views

Secure AWS instance metadata against potential SSRF

I am running a Windows instance on AWS. The instance has an IIS service running on it. The IIS service has a user associated to it and it has no need to access the AWS instance metadata. I was ...
8
votes
2answers
247 views

Is open-source infrastructure safe?

My AWS infrastructure is publicly available here. Is this a security concern? I was prompted to ask this following the Capital One breach and after learning about https://opensourceinfra.org/ Please ...
0
votes
0answers
31 views

Is the example Amazon SNS Topic Policy for CloudTrail too permissive?

I'm trying to configure several AWS accounts to log CloudTrail to a central logging account, from which the logs will be brought into Splunk. In order to do this, I need to configure CloudTrail on ...
4
votes
1answer
48 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
1
vote
2answers
153 views

S3 Bucket Name Obscurity as Security

Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. * Can I assume that a public S3 ...
1
vote
2answers
92 views

Securely provide AWS user with keys?

When creating a new user in AWS IAM, an admin sets the user's name and permissions for that user. The user's password and programmatic access keys (if programmatic access is granted) are then ...
0
votes
1answer
47 views

Managing DUKPT keys in AWS cloud

I work on a payments system. So DUKPT keys are a must-have requirement. In most cases PIN and Card data are encrypted using DUKPT keys. However, every time we have checked with AWS, we have found ...
1
vote
0answers
49 views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
0
votes
2answers
116 views

Can I rely on Operating System (OS) Anti Virus (AV) scanning to scan files shares?

I have an EC2 instance with an Windows OS with anti virus installed. I have a requirement to attach a file share to the OS where the application is hosted. The file share is Amazon Fsx ( Amazon's ...
0
votes
0answers
54 views

Are AWS security groups enough to segment network and reduce PCI scope?

I was reading this paper https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf It shows this image Am I correct in saying that - as long as instances have proper security groups that ...
0
votes
0answers
42 views

Gmail's MFA for team?

We have mailboxes on G-Suite from Goole. Currently, we are enabling MFA for all boxes in our team, but what boxes which are used by different people? For now, I found a few solutions, each with its ...
1
vote
0answers
69 views

Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS

I'm a bit new to coding backend services. And I'm not sure how to solve this problem. So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
1
vote
1answer
65 views

AWS S3 resource access control through IAM permissions or bucket policies?

The way we create buckets in our org and ensure sane ACLs around it is by providing an automated tool (that internally uses Terraform) to provision an S3 bucket. So say when a user requests for a new ...
0
votes
1answer
105 views

Is detecting if an email has an account considered a vulnerability with AWS cognito?

Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS. during the forget password flow, I noticed that Cognito request ...
2
votes
1answer
69 views

Amazon Web Services ELB has permission to change DNS records by default?

I'm creating an ECS (Elastic Container Service) service on AWS. For that service, I need to supply an application load balancer. The default role for it is the following: AWSServiceRoleForECS. When I ...
0
votes
0answers
53 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
1
vote
0answers
48 views

What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?

I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
1
vote
1answer
125 views

Is it Possible to Prevent a Physcial Attack on Server in Remote Data Center?

I've been using Amazon Web Services to run my Java application. However, due to high costs I'm looking into getting a dedicated server from Hetzner, a company based in Germany, which costs about 10-...
0
votes
1answer
71 views

is there any need to encrypt sensitive images in a database?

I have a project that requires users to submit a photo of a driver's license as proof of identity. This image just needs to be seen once by an administrator, and has no use after their id is verified. ...
0
votes
1answer
149 views

How to disclose an open S3 bucket?

What is the most responsible way of disclosing an open AWS S3 bucket? Let's say there are sensitive documents inside, such as contracts with the company logo, that lead you to believe that it ...
0
votes
1answer
79 views

Is it possible to securely run user defined python code in AWS?

I would like to create an app that accepts users python scripts and executes them as part of its functionality. What I am wondering is if its possible to block I/O, network and other attack vectors so ...
1
vote
0answers
72 views

Is there a way to get a forensic image of EC2 instance [closed]

I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
1
vote
2answers
151 views

Differences between the Root user and users with AdministratorAccess in AWS

I am trying to determine the differences (if any) between using the AWS Root user, or a user within the AdministratorAccess group in AWS. The AdministratorAccess is given the following privileges: { ...
1
vote
1answer
61 views

How we can PoC our product that needs training data for our machine learning algorithm of the the bank clients?

Recently, we have had a challenge with potential future clients which are the bank. Our product requires to gather static data (e.g. address, loans, last 50 transactions, etc) of banks clients. These ...
0
votes
0answers
161 views

Information disclosure with AWS response headers

I'm currently testing a web application hosted on AWS. In the response headers, I've noticed various Amazon-related headers, I've never really seen before. The headers include: x-amzn-RequestId: <...
0
votes
0answers
166 views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
2
votes
1answer
388 views

Security Audit on AWS - question on findings

Just wondering about an assessment I'm doing regarding a client's AWS environment. I'm new to AWS to I'm having to learn a lot on the go. I used ScoutSuite and got some findings, specifically: EC2: *...
1
vote
1answer
281 views

How can I encrypt messages sent over AWS PrivateLink?

I am working on a project where I need to send messages to a partner via AWS PrivateLink. Because these messages contain PII, the data needs to be secure. I have been unable to determine from internet ...
1
vote
0answers
27 views

Nmap showing different open ports every few seconds [duplicate]

I'm running Nmap on an Amazon Web Services EC2 instance but between runs just a couple seconds apart, I'm getting new results. Is this normal? I'm seeing open ports then they don't show. I'm running ...
0
votes
1answer
194 views

Windows Server: Import HSM-backed certificate into second server

Scenario: Using Amazon CloudHSM with CloudHSM Windows Client installed and configured. Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider. Submitted ...
0
votes
0answers
28 views

Communicating with things on AWS IoT without certificates problem

Is "IAM" access the only method to gain access AWS? I'm asking because I'm using AWS IoT. With AWS IoT we create things such as devices on AWS IoT Core. However, with IAM access, after creating a "...
0
votes
1answer
56 views

Explanation of the authentication procedure when using signed certificates [duplicate]

I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT. On my device side, I have a device certificate ( deviceCert.crt ) and the device ...
0
votes
0answers
96 views

What is Amazon's GDPR role with Alexa for Business Conferencing?

With respect to GDPR and the Alexa for Business conferencing solution, is Amazon acting in the capacity of a data controller or a data processor, or even a sub-processor? Here's some information on ...
0
votes
0answers
81 views

How to fix AWS security ALAS-2019-1149?

I need to investigate for the security hole ALAS-2019-1149(https://alas.aws.amazon.com/ALAS-2019-1149.html) which is report ed by AWS. I saw in the session "Issue Correction" Run yum update kernel to ...
1
vote
1answer
72 views

Should I take (Pen test) approval from AWS for Fuzz testing my Application API's hosted on AWS? [closed]

I wanted to Fuzz Tests my API's on my own stack which are hosted on AWS environment (Have used lambdas and API gateway) There are mostly GET APIs and only one PUT API.My requirement is to Fuzz Test ...
4
votes
1answer
71 views

Is there any harm to writing a short plain-text string to authorized_keys?

I have a CFN template where I'm seeding an authorized key for testing via paramaters, through a build server. If this value is not provided by the build job, it defaults to a short, plain text string, ...
1
vote
1answer
135 views

Is my server under some kind of reconnaisance/attack?

Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server. I don't have those ...
2
votes
0answers
332 views

Using Google Authentication with Lambda@Edge and S3 Static Sites

I am looking to set up authentication on an S3 hosted static site. The configuration is: S3 bucket configured to allow access via cloudfront AWS Cloudfront distribution with HTTPS configured and a ...
1
vote
2answers
287 views

Penetration Testing authorization from AWS

We have a few web applications newly hosted on AWS. Before we run an automated pentest on the our Application URL using Netsparker, we had always e-mailed Amazon and requested authorization for the ...
0
votes
2answers
148 views

Is AWS subnets enough for segregation of networks? or do we need VPC?

Is AWS subnets enough for segregation of networks with the all security groups? or do we need VPC to really issolate two application from each other?
0
votes
0answers
38 views

Anyway of finding connected devices on a vpn router from the VPN server itself?

I've setup my own OpenVpn server on AWS using an EC2 instance and I have a router with OpenWRT configured to connect to the VPN Server. Now, I want to have some EC2 running network scans such as NMAP ...
2
votes
1answer
45 views

What is the impact of leaving disabled root key on AWS instance?

I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance. When asked to remove the root key, he said it's disabled now so what's the ...
2
votes
1answer
69 views

What attack vectors does AWS SSE-S3 help mitigate?

Reading into the various SSE options on S3, I'm can't understand the following: What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against? I can only think of ...