Questions tagged [aws]
Amazon Web Services (AWS) are a set of cloud services offered by Amazon.
274
questions
0
votes
1
answer
220
views
After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?
I have a private S3 bucket. I want a user from an external organisation to have access.
I have added a user in IAM. How does this external user get notified and how do I share credentials?
The secret ...
CommunityBot
- 1
2
votes
3
answers
1k
views
Making S3 objects viewable only for logged in users
As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve ...
CommunityBot
- 1
0
votes
1
answer
800
views
Isolation AWS resources with multiple subnets vs multiple VPCs
I have AWS resources (e.g. EC2s, RDS instances) that I would like to isolate from each other so that if one is compromised, the potential damage is limited. I am most concerned about data leakage / ...
CommunityBot
- 1
0
votes
1
answer
387
views
Are AWS security groups enough to segment network and reduce PCI scope?
I was reading this paper
https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf
It shows this image
Am I correct in saying that - as long as instances have proper security groups that ...
CommunityBot
- 1
2
votes
2
answers
71
views
Security Concern Opening Up Azure VM to AWS IPs
We have an IIS webserver hosted in Azure. We want to monitor this server via our cloud SIEM hosted in AWS. To monitor, there is a requirement to open outbound 443, on the VM, to a few hundred AWS ...
CommunityBot
- 1
0
votes
1
answer
235
views
AWS IAM policies that differentiate between console & access key access
Question:
How can an AWS IAM policy be devised to differentiate between a console (web) and access key (API) access?
Use Case:
Say, I want to allow the a certain group of users full IAM privileges ...
CommunityBot
- 1
0
votes
0
answers
10
views
How to connect to AWS VPN from a country that blocks most VPNs [migrated]
For work, I must connect to AWS cloud services via the AWS VPN app that my company setup on the company laptop that I use. The AWS VPN only provides access to my company's space in AWS (EC2, S3, ...
- 101
0
votes
0
answers
21
views
Is it risky to include .env files in the .zip which is uploaded to Elastic Beanstalk for deployment? If so, what is the risk?
Is it okay to upload .env files containing client ID and client secret to elastic beanstalk? If not, what is the risk involved? How would one access those files?
- 113
1
vote
1
answer
84
views
Public client or Confidential client: should I generate a client secret?
I've read about this but I don't fully understand how to choose.
I have two options:
Public client
"A native, browser or mobile-device app. Cognito API requests are made from user systems that ...
- 113
1
vote
2
answers
309
views
Solutions for backing-up my codebase
I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github ...
CommunityBot
- 1
0
votes
1
answer
47
views
Does using Apache/nginx actually improve security of a webapp?
Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the ...
- 198k
1
vote
0
answers
45
views
Prevention of access to user data running on the cloud
I am building a web-based software as a service (SaaS) platform for engineering simulations that run on the cloud, and wish to prevent my access to user data by design. The user designs a 3D geometry (...
- 129
0
votes
1
answer
389
views
AWS Service-To-Service authentication via Identity document
In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
CommunityBot
- 1
1
vote
2
answers
341
views
How to manage Encryption Key for Server Side Encryption in AWS S3
I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows:
All the existing data ...
CommunityBot
- 1
0
votes
1
answer
60
views
e-signature + digital signature aws md5
I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents.
My question are:
Is MD5 (...
CommunityBot
- 1
1
vote
1
answer
529
views
How secure is SSL private key in AWS ELB service?
We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
CommunityBot
- 1
5
votes
2
answers
141
views
Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers
We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
- 3,119
5
votes
3
answers
298
views
How can one centrally manage / audit AWS resource-based policies
An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
CommunityBot
- 1
1
vote
1
answer
131
views
Using AWS System Manager Parameter Store SecureString in config file in ec2
On an ec2 box I am running a service that reads vars from a config file. One var's value is stored in AWS System Manager as a SecureString. I want to use that value in the text file securely.
I can ...
CommunityBot
- 1
0
votes
1
answer
833
views
How do I get a forensic copy of an EC2 server?
Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
CommunityBot
- 1
1
vote
0
answers
53
views
Using API key as public key and IP address as private key to WASM application
I'm trying to offer a service to users that allows them to write Python via pyodide or R code via webR in their browser against my own data. I've been thinking of ways to go about this and I'm curious ...
- 128k
1
vote
1
answer
183
views
Explanation of the AWS IAM PassRole vulnerability
Help me understand what the risk in the AWS Privilege Escalation Vulnerabilities article is.
I think it is normal that I create an EC2 instance and associate an IAM role as its instance profile, and ...
- 1,820
5
votes
1
answer
3k
views
Understanding ssh-rsa not in PubkeyAcceptedAlgorithms
I am having problem in connecting to an Amazon EC2 Linux instance from an old Mac OS machine running El Capitan. Unfortunately without any possibility to upgrade the OS.
Because all the other modern ...
- 153
1
vote
1
answer
1k
views
AWS RDS Database access from Github Actions
I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS.
The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
- 111
1
vote
1
answer
250
views
Should an AWS Lambda trust-policy be narrowly scoped?
Should trust policies for AWS Lambda be narrowly scoped, and how can this be implemented (e.g. using Terraform)?
Using Terraform I ran into a cyclic dependency problem as follows: an AWS Lambda ...
- 3,119
2
votes
0
answers
29
views
AWS sub-accounts to protect against deletion of versioned data in S3
How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
- 135
0
votes
0
answers
41
views
Is is bad that on-prem "prod" DB is accessible/visible from in-cloud dev environment?
We have our dev & prod env split between AWS (databricks workspaces) and on-prem Linux boxes. Specifically, we have DB instances on-prem and have python code running inside our databricks ...
- 113
1
vote
1
answer
49
views
Is my Jupyter notebook on EC2 secure?
I have a product I am making available to some users that runs via a Jupyter notebook. I deploy Jupyter inside of a docker container to an EC2 host. Each user gets an instance I'll send to them. For ...
- 3,821
0
votes
1
answer
115
views
Understanding AWS/KMS Keyring Encryption, Genkeys and Plaintext Data Keys
I'm reading up on the AWS Encryption SDK (JavaScript flavor but this is the same for Python and Java, and my question is really on the underlying security principles, which are language agnostic). On ...
CommunityBot
- 1
1
vote
1
answer
96
views
Is handling keys with vps without kms secure?
I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the ...
- 15.4k
0
votes
1
answer
116
views
Confidential Computing - SQL Server Always Encrypted w/ Secure Enclave - Customer Managed Keys or alternative
I am looking into ways to build a data warehouse that would house confidential data for 1+ clients. The requirement is that our organization can never obtain access to the decrypted data. There would ...
0
votes
0
answers
261
views
Why am I able to access EC2 metadata endpoint from within a Docker container running in the EC2
My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether ...
- 1,522
0
votes
2
answers
967
views
Windows Server: Import HSM-backed certificate into second server
Scenario:
Using Amazon CloudHSM with CloudHSM Windows Client installed and configured.
Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider.
Submitted ...
1
vote
2
answers
2k
views
Amazon AWS S3 Unrestricted File Upload
While I was pentesting a web application, I found out that files that are uploaded to the web application are stored in an AWS S3 instance. Based on my experience, when a web application needs to ...
- 261
0
votes
1
answer
852
views
Is using route 53 from AWS sufficient for DDOS protection on DNS level, or do you need to combine it with other AWS products
We have been targeted by DNS DDOS attacks. We have now migrated to AWS Route53 as these DNS servers are more resilient.
Is using AWS Route 53 enough to have basic DDOS protection? Or is it necessary ...
- 99
1
vote
1
answer
189
views
Network address (DNS) translation on Amazon Web Services (Ec2)
I am trying to figure out better ways to practice my computer defense/ infosec skills. If someone was to set up a honeypot (e.g., MHN) on AWS/EC2 server and then try to launch attacks from a local ...
- 3,119
0
votes
2
answers
165
views
Does AWS security group block unintentionally exposed ports from Docker?
My typical cloud server hardening includes blocking ports at the UFW level on the server as well as at the AWS security group level.
I recently learned that Docker overwrites your IPTables. Given that,...
- 180
4
votes
1
answer
866
views
Security implications of using public subnets in AWS VPC for hosting web and job servers
I have been using AWS for hosting personal projects, mostly in the form of containerized Django web apps running on ECS with Fargate. I have referenced this article to better understand Fargate task ...
- 258
0
votes
1
answer
513
views
What is the intent behind these unknown HTTP Requests into my AWS Web Server?
I know about the usual port sniffers and mass scanners that just pop up on any web server, but this one looks interesting to me.
I figured out so far that those requests aren't really an issue for my ...
- 128
3
votes
1
answer
157
views
Securely retrieving and exposing configuration within Docker
It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
CommunityBot
- 1
2
votes
2
answers
133
views
Do CloudFront edges talk to custom origins over open (non-AWS) networks?
Where the custom origin server for an AWS CloudFront distribution is an EC2 instance accessible with a public DNS record, do CloudFront edge locations talk to it over the open Internet — as opposed to ...
- 3,691
0
votes
1
answer
122
views
Is someone trying to attack our API
I created a service with elastic beanstalk in AWS 2 or 3 hours ago.
EC2 is in private subnet and load balancer is in public subnet.
When I look to logs I saw these requests.
What are they?
- 945
0
votes
2
answers
66
views
Would the TCP port of a VPN with access to the VPC be considered as a "Server administration port" in CIS benchmark?
I'm deploying an AWS Infrastructure that should adhere the CIS Benchmark.
I'm trying to understand if the TCP port of the VPN server that permits access to the VPC has to be considered as a "...
- 1,820
0
votes
1
answer
101
views
How to know if an Amazon AWS server is safe or not?
I see connections to Amazon AWS servers, and since everyone can register servers on Amazon, how do I know if my PC communicating with a safe Amazon server, or with a server which a hacker registered?
...
- 198k
1
vote
1
answer
507
views
Why do I need an IDS/IPS in a serverless cloud environment?
Following this question (Why do we need IDS/IPS if a firewall is present?) from a few years back, I am trying to take this subject to the cloud.
Assuming that I have a fully "serverless" AWS ...
- 1,820
1
vote
1
answer
229
views
Can the services inside the VPC be authentication less?
We have a micro-services architecture, where many microservers need to talk to each other for data.
These services are inside a VPC.
I need to understand if the HTTP APIs of these microservices need ...
- 2,017
0
votes
2
answers
187
views
Docker, running programs as Root and AWS
It is well known that running programs inside your docker container as root is bad practice. As far as I can tell, the reason for this is because root on the container is rather similar to root on the ...
- 62.1k
0
votes
1
answer
1k
views
SCP to create security groups in member AWS account
I'm trying to create a SCP to restrict member account users to create/modify security group(s) that have inbound rule for SSH/RDP with Source set as 0.0.0.0 or ::/0.
Basically, I want users to SSH ...
- 3,691
2
votes
2
answers
3k
views
How can I encrypt messages sent over AWS PrivateLink?
I am working on a project where I need to send messages to a partner via AWS PrivateLink. Because these messages contain PII, the data needs to be secure. I have been unable to determine from internet ...
- 486
0
votes
1
answer
84
views
what is benefit of using KMS to "encrypt" between two AWS users, instead of just sending directly through AWS?
I am just learning KMS and how granting encrypt/decrypt permissions on KMS keys works, but I don't understand what is the benefit of using KMS to encrypt data to send to another AWS customer, who then ...
- 58.8k