A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

Filter by
Sorted by
Tagged with
1
vote
1answer
33 views

EKS managed worker nodes security patching

Do AWS EKS managed nodes receive security patching automatically or is it the owner's responsibility to patch?
0
votes
0answers
37 views

Is it secure to rely on the data in a lambda context authorizer claims?

I am working on lambda authorization and I learned that there are generally two options. Either use the default authorizer on the API gateway level, which will do all the heavy lifting (validate the ...
1
vote
0answers
23 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
0
votes
0answers
24 views

Where does packer store the private key? [migrated]

From ubuntu shell I ran below command, to talk to AWS platform: $ packer build -debug template.packer Debug mode enabled. Builds will not be parallelized. amazon-ebs output will be in this color. ==...
1
vote
0answers
32 views

concatenation vs multiple rounds of HMAC

I was studying the AWS request signature process and found that they derive the signing key from multiple sources (one and two related questions). Specifically this: kSecret = Your AWS Secret Access ...
0
votes
0answers
29 views

Amazon S3 policies: CORS or Service Accounts?

I have a question about accessing buckets on AWS S3. Let's suppose we have a bucket that has to have public read access by everyone and only my API has to be able to PUT and DELETE items from bucket. ...
1
vote
3answers
107 views

Why AWS distributes private key to address authentication problem?

AWS provides access to EC2 by downloading the private key(.pem) into management host that connects to EC2. AWS uses openssl tool Key providers generally provide public key but not private key, ...
1
vote
1answer
158 views

Are these log messages in my nginx server evidence of an attempted attack?

My AWS Elastic Beanstalk server is often reporting Environment health has transitioned from Ok to Severe. 100.0 % of the requests are erroring with HTTP 4xx. This happens almost daily for a few ...
4
votes
1answer
76 views

PCI compliance with multiple AWS VPCs

If I have VPC which is in-scope (the "PCI VPC") and another which is not (the "NON-PCI VPC"), would peering them bring the non-pci vpc in-scope? Is there a way to avoid this? I have an aurora RDS ...
0
votes
1answer
57 views

Is there any Security issue if we not used SSL between AWS Cloudfront and AWS ALB?

I have an application that is hosted on AWS. It has an Application Load Balancer in its front and it is also attached to the Cloudfront to handle a heavy load. In my case, I have enabled SSL only on ...
1
vote
1answer
62 views

AWS serverless site security. Anything else I should add? [closed]

I have an AWS static site in an S3 bucket, accessible through CloudFront and a bunch of lambda functions that form the backend of the site. Is there anything else I can/should do security wise to ...
0
votes
0answers
30 views

How can I give a network load balancer (of any type) access to a port on a machine without opening that port to an entire VPC?

Is it possible to make an AWS load balancer for a non-HTTP port allowed to access a specific port on a host without opening that port open to the entire VPC's subnet? I seem to remember reading that ...
0
votes
0answers
19 views

Is Bucket Upload Policy a good pratice for upload files to AWS S3?

In AWS docs page has the following instructions to upload files to an AWS bucket from browser: https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html This solution send to browser a ...
1
vote
1answer
35 views

Getting data from AWS Secrets Manager at deployment (ENV variables) vs. at run-time (e.g. aws-sdk)

Given a serverless deployment of some kind (i.e. something that relies on AWS Lambda for computing), and secrets stored in AWS Secrets Manager, what difference from security standpoint is there ...
1
vote
1answer
88 views

How to harden against credential stealing in EC2 via the http://169.254.169.254 API?

AWS has a feature called Instance Metadata, which on EC2 gives you access to the AWS credentials through HTTP calls: curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> ...
3
votes
1answer
167 views

Why isn't cloud (AWS, Azure, GCP) metadata served over HTTPS?

Why can any application or user on your server type an insecure URL like these to get server information about that instance? http://instance-data.us-east-1.compute.internal/latest/meta-data/ http://...
0
votes
0answers
41 views

Is it OK to use HTTP for internal communication between two micro-services deployed on AWS ECS fargate?

I have micro services deployed as AWS ECS Fargate containers. For internal communication they are using service discovery end point. In my opinion, it is OK to use HTTP for internal communication. ...
0
votes
1answer
47 views

TLS certificate - How to assign a CN name for an EC2?

AWS console(EC2 dashboard) shows public DNS name as ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com for an EC2 instance. But the same AWS EC2 has a different DNS name (shown below): $ hostname -...
1
vote
0answers
43 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
1
vote
2answers
57 views

Serverless Apps Authenticate Users After Page Load - Flaw?

Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn't sent from the user's browser, the only content delivered to the user is a ...
23
votes
4answers
5k views

More than three domains hosted on the same IP address

Not on purpose I did a reverse IP address look up on my site, and it shows that there are three other websites hosted on my server, and now I'm worried. My web is arturofm.com, and here is the lookup:...
1
vote
0answers
23 views

Recomendation for automated rotation of a JSON keyring? [closed]

I have a Sailsjs app that is configured to encrypt model attributes with sensitive information. This seems to use bcrypt, under the hood and leverages a JSON keyring in the configuration (...
1
vote
1answer
64 views

Is encryption/decryption done in the cloud when using CMK keys?

I am trying to understand how AWS KMS works, and there is one thing I am still not completely sure of: when using CMKs, so no Data Keys, no envelop encryption, does the encryption take place in the ...
2
votes
2answers
83 views

Secure AWS instance metadata against potential SSRF

I am running a Windows instance on AWS. The instance has an IIS service running on it. The IIS service has a user associated to it and it has no need to access the AWS instance metadata. I was ...
8
votes
2answers
255 views

Is open-source infrastructure safe?

My AWS infrastructure is publicly available here. Is this a security concern? I was prompted to ask this following the Capital One breach and after learning about https://opensourceinfra.org/ Please ...
0
votes
0answers
39 views

Is the example Amazon SNS Topic Policy for CloudTrail too permissive?

I'm trying to configure several AWS accounts to log CloudTrail to a central logging account, from which the logs will be brought into Splunk. In order to do this, I need to configure CloudTrail on ...
5
votes
1answer
65 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
1
vote
2answers
243 views

S3 Bucket Name Obscurity as Security

Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. * Can I assume that a public S3 ...
1
vote
2answers
105 views

Securely provide AWS user with keys?

When creating a new user in AWS IAM, an admin sets the user's name and permissions for that user. The user's password and programmatic access keys (if programmatic access is granted) are then ...
0
votes
1answer
98 views

Managing DUKPT keys in AWS cloud

I work on a payments system. So DUKPT keys are a must-have requirement. In most cases PIN and Card data are encrypted using DUKPT keys. However, every time we have checked with AWS, we have found ...
1
vote
1answer
270 views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
0
votes
2answers
139 views

Can I rely on Operating System (OS) Anti Virus (AV) scanning to scan files shares?

I have an EC2 instance with an Windows OS with anti virus installed. I have a requirement to attach a file share to the OS where the application is hosted. The file share is Amazon Fsx ( Amazon's ...
0
votes
0answers
72 views

Are AWS security groups enough to segment network and reduce PCI scope?

I was reading this paper https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf It shows this image Am I correct in saying that - as long as instances have proper security groups that ...
0
votes
0answers
45 views

Gmail's MFA for team?

We have mailboxes on G-Suite from Goole. Currently, we are enabling MFA for all boxes in our team, but what boxes which are used by different people? For now, I found a few solutions, each with its ...
1
vote
0answers
83 views

Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS

I'm a bit new to coding backend services. And I'm not sure how to solve this problem. So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
1
vote
1answer
82 views

AWS S3 resource access control through IAM permissions or bucket policies?

The way we create buckets in our org and ensure sane ACLs around it is by providing an automated tool (that internally uses Terraform) to provision an S3 bucket. So say when a user requests for a new ...
0
votes
1answer
157 views

Is detecting if an email has an account considered a vulnerability with AWS cognito?

Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS. during the forget password flow, I noticed that Cognito request ...
2
votes
1answer
75 views

Amazon Web Services ELB has permission to change DNS records by default?

I'm creating an ECS (Elastic Container Service) service on AWS. For that service, I need to supply an application load balancer. The default role for it is the following: AWSServiceRoleForECS. When I ...
0
votes
0answers
53 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
1
vote
0answers
51 views

What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?

I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
1
vote
1answer
167 views

Is it Possible to Prevent a Physcial Attack on Server in Remote Data Center?

I've been using Amazon Web Services to run my Java application. However, due to high costs I'm looking into getting a dedicated server from Hetzner, a company based in Germany, which costs about 10-...
0
votes
1answer
73 views

is there any need to encrypt sensitive images in a database?

I have a project that requires users to submit a photo of a driver's license as proof of identity. This image just needs to be seen once by an administrator, and has no use after their id is verified. ...
0
votes
1answer
180 views

How to disclose an open S3 bucket?

What is the most responsible way of disclosing an open AWS S3 bucket? Let's say there are sensitive documents inside, such as contracts with the company logo, that lead you to believe that it ...
0
votes
1answer
84 views

Is it possible to securely run user defined python code in AWS?

I would like to create an app that accepts users python scripts and executes them as part of its functionality. What I am wondering is if its possible to block I/O, network and other attack vectors so ...
1
vote
0answers
77 views

Is there a way to get a forensic image of EC2 instance [closed]

I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
1
vote
2answers
284 views

Differences between the Root user and users with AdministratorAccess in AWS

I am trying to determine the differences (if any) between using the AWS Root user, or a user within the AdministratorAccess group in AWS. The AdministratorAccess is given the following privileges: { ...
1
vote
1answer
63 views

How we can PoC our product that needs training data for our machine learning algorithm of the the bank clients?

Recently, we have had a challenge with potential future clients which are the bank. Our product requires to gather static data (e.g. address, loans, last 50 transactions, etc) of banks clients. These ...
0
votes
0answers
265 views

Information disclosure with AWS response headers

I'm currently testing a web application hosted on AWS. In the response headers, I've noticed various Amazon-related headers, I've never really seen before. The headers include: x-amzn-RequestId: <...
0
votes
0answers
396 views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
2
votes
1answer
630 views

Security Audit on AWS - question on findings

Just wondering about an assessment I'm doing regarding a client's AWS environment. I'm new to AWS to I'm having to learn a lot on the go. I used ScoutSuite and got some findings, specifically: EC2: *...