Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

Filter by
Sorted by
Tagged with
0 votes
1 answer
502 views

AWS Service-To-Service authentication via Identity document

In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
-1 votes
0 answers
37 views

Protect out SES SMTP details [closed]

We are using SES SMTP with cPanel webmail (Exim) and PHP to send emails. This issue happened today and last week. Currently, We have the credentials in 2 places: 1- Exim configuration. 2- PHP files. ...
1 vote
2 answers
403 views

How to manage Encryption Key for Server Side Encryption in AWS S3

I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows: All the existing data ...
0 votes
1 answer
111 views

e-signature + digital signature aws md5

I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents. My question are: Is MD5 (...
0 votes
1 answer
47 views

How do AWS "Pod Identities" compare to (OIDC) IRSA?

In Kubernetes clusters, we often wish to provide temporary credentials to the containerised processes running in a particular pod, usually marked by associating the pod with a service account. ...
1 vote
1 answer
583 views

How secure is SSL private key in AWS ELB service?

We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
5 votes
3 answers
337 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
1 vote
1 answer
210 views

Using AWS System Manager Parameter Store SecureString in config file in ec2

On an ec2 box I am running a service that reads vars from a config file. One var's value is stored in AWS System Manager as a SecureString. I want to use that value in the text file securely. I can ...
0 votes
0 answers
64 views

AWS Key stolen out of Github Actions / Secret Store

Do you have an idea how my AWS credentials could be stolen in the following setup: A 4 weeks old GitHub organization with 5 repositories & AWS Account AWS CI User Credentials with Administration ...
0 votes
0 answers
19 views

Google SAML auth not working through APP tile but works with direct link

We've recently migrated from Okta to Google for work for AWS authentication. Our amazon org authentication is setup through IAM Identity center. It was working flawlessly using Okta but since we ...
0 votes
0 answers
87 views

AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment

Let's say we produce IoT devices and want them to access AWS IoT Core. The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
0 votes
1 answer
1k views

How do I get a forensic copy of an EC2 server?

Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
0 votes
1 answer
394 views

After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?

I have a private S3 bucket. I want a user from an external organisation to have access. I have added a user in IAM. How does this external user get notified and how do I share credentials? The secret ...
2 votes
3 answers
2k views

Making S3 objects viewable only for logged in users

As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve ...
0 votes
1 answer
1k views

Isolation AWS resources with multiple subnets vs multiple VPCs

I have AWS resources (e.g. EC2s, RDS instances) that I would like to isolate from each other so that if one is compromised, the potential damage is limited. I am most concerned about data leakage / ...
0 votes
1 answer
468 views

Are AWS security groups enough to segment network and reduce PCI scope?

I was reading this paper https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf It shows this image Am I correct in saying that - as long as instances have proper security groups that ...
2 votes
2 answers
107 views

Security Concern Opening Up Azure VM to AWS IPs

We have an IIS webserver hosted in Azure. We want to monitor this server via our cloud SIEM hosted in AWS. To monitor, there is a requirement to open outbound 443, on the VM, to a few hundred AWS ...
7 votes
3 answers
6k views

How to securely store secrets in Docker container?

The application I'm working on has more than a dozen of secrets, SSL certificates and API keys. Currently I have a file that's added into .gitignore and it contains all my secrets. How to securely ...
0 votes
1 answer
299 views

AWS IAM policies that differentiate between console & access key access

Question: How can an AWS IAM policy be devised to differentiate between a console (web) and access key (API) access? Use Case: Say, I want to allow the a certain group of users full IAM privileges ...
6 votes
0 answers
9k views

What does a POST like 0x%5B%5D=somename try to achieve? [closed]

We created a default environment on AWS Elastic Beanstalk using their Python "sample app". After some time, the logs show a large number of POST requests with bodies like this: b'0x%5B%5D=...
0 votes
1 answer
83 views

Why is ip forwarding for a ECS instance being flagged as a vulnerability?

I am very new to this and was asked to address some security patches on various ec2 instances in our AWS account. Mostly this was a matter of using the Security Manager to connect to the instance and ...
2 votes
0 answers
110 views

How are companies automatically rotating secrets such as API keys?

We currently rotate AWS-specific secrets via AWS Secrets Manager without much issue. However, we are looking to also rotate secrets e.g. API keys for specific services, but AWS Secrets Manager does ...
0 votes
0 answers
76 views

Risk for a public RDS database on AWS

I have a RDS database on a VPC which is public with a password. I have some lambda functions (that are not in a VPC) that communicates with this database. To be able to do that I had to modify the ...
3 votes
1 answer
339 views

How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?

Problem Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*. ...
0 votes
0 answers
76 views

Is it risky to include .env files in the .zip which is uploaded to Elastic Beanstalk for deployment? If so, what is the risk?

Is it okay to upload .env files containing client ID and client secret to elastic beanstalk? If not, what is the risk involved? How would one access those files?
2 votes
1 answer
484 views

Public client or Confidential client: should I generate a client secret?

I've read about this but I don't fully understand how to choose. I have two options: Public client "A native, browser or mobile-device app. Cognito API requests are made from user systems that ...
1 vote
2 answers
363 views

Solutions for backing-up my codebase

I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github ...
0 votes
1 answer
102 views

Does using Apache/nginx actually improve security of a webapp?

Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the ...
1 vote
0 answers
87 views

Prevention of access to user data running on the cloud

I am building a web-based software as a service (SaaS) platform for engineering simulations that run on the cloud, and wish to prevent my access to user data by design. The user designs a 3D geometry (...
5 votes
2 answers
204 views

Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers

We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
2 votes
0 answers
115 views

Using API key as public key and IP address as private key to WASM application

I'm trying to offer a service to users that allows them to write Python via pyodide or R code via webR in their browser against my own data. I've been thinking of ways to go about this and I'm curious ...
1 vote
1 answer
350 views

Explanation of the AWS IAM PassRole vulnerability

Help me understand what the risk in the AWS Privilege Escalation Vulnerabilities article is. I think it is normal that I create an EC2 instance and associate an IAM role as its instance profile, and ...
6 votes
1 answer
8k views

Understanding ssh-rsa not in PubkeyAcceptedAlgorithms

I am having problem in connecting to an Amazon EC2 Linux instance from an old Mac OS machine running El Capitan. Unfortunately without any possibility to upgrade the OS. Because all the other modern ...
1 vote
1 answer
2k views

AWS RDS Database access from Github Actions

I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS. The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
1 vote
1 answer
413 views

Should an AWS Lambda trust-policy be narrowly scoped?

Should trust policies for AWS Lambda be narrowly scoped, and how can this be implemented (e.g. using Terraform)? Using Terraform I ran into a cyclic dependency problem as follows: an AWS Lambda ...
2 votes
0 answers
68 views

AWS sub-accounts to protect against deletion of versioned data in S3

How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
1 vote
1 answer
94 views

Is my Jupyter notebook on EC2 secure?

I have a product I am making available to some users that runs via a Jupyter notebook. I deploy Jupyter inside of a docker container to an EC2 host. Each user gets an instance I'll send to them. For ...
0 votes
1 answer
203 views

Understanding AWS/KMS Keyring Encryption, Genkeys and Plaintext Data Keys

I'm reading up on the AWS Encryption SDK (JavaScript flavor but this is the same for Python and Java, and my question is really on the underlying security principles, which are language agnostic). On ...
1 vote
1 answer
142 views

Is handling keys with vps without kms secure?

I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the ...
0 votes
1 answer
187 views

Confidential Computing - SQL Server Always Encrypted w/ Secure Enclave - Customer Managed Keys or alternative

I am looking into ways to build a data warehouse that would house confidential data for 1+ clients. The requirement is that our organization can never obtain access to the decrypted data. There would ...
0 votes
0 answers
424 views

Why am I able to access EC2 metadata endpoint from within a Docker container running in the EC2

My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether ...
0 votes
2 answers
1k views

Windows Server: Import HSM-backed certificate into second server

Scenario: Using Amazon CloudHSM with CloudHSM Windows Client installed and configured. Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider. Submitted ...
1 vote
2 answers
2k views

Amazon AWS S3 Unrestricted File Upload

While I was pentesting a web application, I found out that files that are uploaded to the web application are stored in an AWS S3 instance. Based on my experience, when a web application needs to ...
0 votes
1 answer
1k views

Is using route 53 from AWS sufficient for DDOS protection on DNS level, or do you need to combine it with other AWS products

We have been targeted by DNS DDOS attacks. We have now migrated to AWS Route53 as these DNS servers are more resilient. Is using AWS Route 53 enough to have basic DDOS protection? Or is it necessary ...
1 vote
1 answer
212 views

Network address (DNS) translation on Amazon Web Services (Ec2)

I am trying to figure out better ways to practice my computer defense/ infosec skills. If someone was to set up a honeypot (e.g., MHN) on AWS/EC2 server and then try to launch attacks from a local ...
0 votes
2 answers
229 views

Does AWS security group block unintentionally exposed ports from Docker?

My typical cloud server hardening includes blocking ports at the UFW level on the server as well as at the AWS security group level. I recently learned that Docker overwrites your IPTables. Given that,...
4 votes
1 answer
1k views

Security implications of using public subnets in AWS VPC for hosting web and job servers

I have been using AWS for hosting personal projects, mostly in the form of containerized Django web apps running on ECS with Fargate. I have referenced this article to better understand Fargate task ...
0 votes
1 answer
729 views

What is the intent behind these unknown HTTP Requests into my AWS Web Server?

I know about the usual port sniffers and mass scanners that just pop up on any web server, but this one looks interesting to me. I figured out so far that those requests aren't really an issue for my ...
3 votes
1 answer
180 views

Securely retrieving and exposing configuration within Docker

It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
2 votes
2 answers
189 views

Do CloudFront edges talk to custom origins over open (non-AWS) networks?

Where the custom origin server for an AWS CloudFront distribution is an EC2 instance accessible with a public DNS record, do CloudFront edge locations talk to it over the open Internet — as opposed to ...

1
2 3 4 5 6