Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

35 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
3answers
113 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
3
votes
0answers
96 views

Can AWS Time Sync be argued PCI compliant?

We're setting up a card processing service on Amazon AWS, and were wondering whether the AWS Time Sync service could be incorporated without running afoul of the PCI time sync requirements? ...
3
votes
0answers
63 views

AWS SSM Agent protection

Our company is moving to the AWS cloud recently, and AWS relies a lot on the SSM agent, it is also opensource. ( https://github.com/aws/amazon-ssm-agent ) From my understanding, this agent is not ...
2
votes
0answers
509 views

Using Google Authentication with Lambda@Edge and S3 Static Sites

I am looking to set up authentication on an S3 hosted static site. The configuration is: S3 bucket configured to allow access via cloudfront AWS Cloudfront distribution with HTTPS configured and a ...
2
votes
1answer
81 views

Securely retrieving and exposing configuration within Docker

It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
2
votes
0answers
4k views

SNI and hostname provided via HTTP are different error

I am using Apache 2.2 webserver on ubuntu Aws instance. My website goes down with below errors on error log, [ssl:error] [pid 46283] AH02032: Hostname provided via SNI and hostname provided via ...
1
vote
1answer
49 views

Why is ID token used instead of Access token to get temporary credentials in AWS?

After a user logons to cognito, he receives access and ID tokens. the ID token contains sensitive info like phone number, email, etc.. From all standards - ID token should not be used to gain access ...
1
vote
0answers
105 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
1
vote
0answers
38 views

concatenation vs multiple rounds of HMAC

I was studying the AWS request signature process and found that they derive the signing key from multiple sources (one and two related questions). Specifically this: kSecret = Your AWS Secret Access ...
1
vote
0answers
43 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
1
vote
0answers
59 views

Is the example Amazon SNS Topic Policy for CloudTrail too permissive?

I'm trying to configure several AWS accounts to log CloudTrail to a central logging account, from which the logs will be brought into Splunk. In order to do this, I need to configure CloudTrail on ...
1
vote
0answers
97 views

Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS

I'm a bit new to coding backend services. And I'm not sure how to solve this problem. So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
1
vote
0answers
60 views

What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?

I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
1
vote
1answer
245 views

How secure is SSL private key in AWS ELB service?

We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
1
vote
0answers
63 views

What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?

When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2. I have gone ...
1
vote
0answers
38 views

Are there any additional security precautions I can or should take with my service?

Suppose I'm building a service to store all the secure or sensitive information that my other applications use. Think passwords, or private SSH keys. Under the old programming paradigm of 'do one ...
1
vote
1answer
210 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
1
vote
0answers
238 views

GDPR compliance in Amazon AWS

Anybody has a nice checklist/todo list to achieve GDPR compliance in Amazon AWS environments? Want to use dev-sec.io checklists, OWASP for web app, AWS Trusted Advisor. Anything else to include/...
1
vote
0answers
389 views

How is SSL encryption maintained between AWS CloudFront and EC2?

So I recently set up an API on an AWS EC2 instance. To be able to serve responses over HTTPS I used Route 53 to redirect my custom domain to a CloudFront distribution which points to the EC2 instance. ...
0
votes
2answers
85 views

Solutions for backing-up my codebase

I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github ...
0
votes
0answers
34 views

Naming AWS resources

For S3 bucket names, anyone can query a bucket name (without specifying an account owner) and see if the bucket is misconfigured to allow public access. Therefore, it arguably makes sense to use a ...
0
votes
0answers
29 views

Are AWS KMS and Google Cloud KMS's HSMs valid as Certified Qualified Signature Creation Devices?

I'm looking into digitally signing documents and planning to use AWS KMS or Google Cloud KMS service to create and manage the private/public keys. Underneath they use Hardware Security Modules (HSMs) ...
0
votes
0answers
52 views

WAF really Needed?

I'm running a company web application in AWS. This web app is behind a cognito+External Identity provider with SAML for only allowing company employees to reach the app (then they log in with local ...
0
votes
0answers
36 views

Can passing credentials as parameters to CloudFormation templates via a build script be secure?

I have a CloudFormation stack that currently resolves credentials from the AWS Systems Manager parameter store. I'd like to change how it gets credentials. Now I would like to: Use the Python ...
0
votes
1answer
50 views

AWS IAM policies that differentiate between console & access key access

Question: How can an AWS IAM policy be devised to differentiate between a console (web) and access key (API) access? Use Case: Say, I want to allow the a certain group of users full IAM privileges ...
0
votes
0answers
48 views

Inverse of Third Party Authentication

Consider this scenario. I have a file hosted on AWS with private access. I want the file to be accessible to several authorized users of a web applicaton that I have built. As I am the one ...
0
votes
0answers
55 views

Is it secure to rely on the data in a lambda context authorizer claims?

I am working on lambda authorization and I learned that there are generally two options. Either use the default authorizer on the API gateway level, which will do all the heavy lifting (validate the ...
0
votes
1answer
65 views

Amazon S3 policies: CORS or Service Accounts?

I have a question about accessing buckets on AWS S3. Let's suppose we have a bucket that has to have public read access by everyone and only my API has to be able to PUT and DELETE items from bucket. ...
0
votes
0answers
35 views

How can I give a network load balancer (of any type) access to a port on a machine without opening that port to an entire VPC?

Is it possible to make an AWS load balancer for a non-HTTP port allowed to access a specific port on a host without opening that port open to the entire VPC's subnet? I seem to remember reading that ...
0
votes
0answers
25 views

Is Bucket Upload Policy a good pratice for upload files to AWS S3?

In AWS docs page has the following instructions to upload files to an AWS bucket from browser: https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html This solution send to browser a ...
0
votes
0answers
47 views

Is it OK to use HTTP for internal communication between two micro-services deployed on AWS ECS fargate?

I have micro services deployed as AWS ECS Fargate containers. For internal communication they are using service discovery end point. In my opinion, it is OK to use HTTP for internal communication. ...
0
votes
0answers
88 views

Are AWS security groups enough to segment network and reduce PCI scope?

I was reading this paper https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf It shows this image Am I correct in saying that - as long as instances have proper security groups that ...
0
votes
0answers
681 views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
0
votes
0answers
100 views

How to fix AWS security ALAS-2019-1149?

I need to investigate for the security hole ALAS-2019-1149(https://alas.aws.amazon.com/ALAS-2019-1149.html) which is report ed by AWS. I saw in the session "Issue Correction" Run yum update kernel to ...
0
votes
0answers
104 views

Meltdown checker says AWS and Rackspace is vulnerable - Why?

Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with 7 of 8 variants OK (the failed one is apparently ...