Questions tagged [aws]
Amazon Web Services (AWS) are a set of cloud services offered by Amazon.
286
questions
4
votes
1
answer
1k
views
Subdomain takeover with A record
I friend of mine has had a subdomain takeover occur. I've taken a look at his DNS and he had some dangling entries, but they were A records, not CNAMEs. The subdomain was pointing to an IP address on ...
- 153
1
vote
1
answer
62
views
Basic monitoring of web applications (http headers, HSTS)
I would like to set up som basic monitoring of outgoing traffic for a number of web applications and api´s running in AWS. E.g.
Ensure specific http headers are in place (Content-Security-Policy and ...
- 141
1
vote
1
answer
77
views
ReDOS - Vulnerability found, but DOS not possible
I have an API which is protected by AWS Cloudfront. I found a ReDos in one of my API Endpoints. The endpoint looks like this:
https://mywebsite.com/api/myendpoint?apikey=xxxx&namefilter=yyyy
The ...
- 11
2
votes
0
answers
31
views
Why is presence of SPN on an account causing Kerberos "failed to decrypt" error (KRB_AP_ERR_MODIFIED)
I am in a corporate environment with on-premises AD on the company.com domain.
We have an AWS VPC hosting some .Net APIs in IIS - the domain these are in is companycloud.com. These APIs are all on the ...
- 141
0
votes
0
answers
37
views
can non-rotatable secrets be stored in ciphertext form in a DB/file/etc.?
We have a service running on AWS. This service uses secrets such as API keys of third party services (in other words: secrets which do not rotate automatically). These secrets are stored in AWS ...
- 101
1
vote
0
answers
31
views
How to manage temporary AWS credentials for on-premises Kubernetes clusters?
We have several on-premises Kubernetes clusters that need to utilize AWS services. Currently, we use traditional IAM Users with static credentials, but we recognize this is a bad practice. We want to ...
1
vote
1
answer
136
views
Why does AWS strongly recommend a non-self-signed, code-signing certificate?
I am developing a hardware device that utilizes AWS IoT OTA via FreeRTOS. On this AWS web page, it says
We recommend that you purchase a code-signing certificate from a
company with a good ...
- 113
0
votes
1
answer
135
views
How do AWS "Pod Identities" compare to (OIDC) IRSA?
In Kubernetes clusters, we often wish to provide temporary credentials to the containerised processes running in a particular pod, usually marked by associating the pod with a service account.
...
- 165
0
votes
0
answers
79
views
AWS Key stolen out of Github Actions / Secret Store
Do you have an idea how my AWS credentials could be stolen in the following setup:
A 4 weeks old GitHub organization with 5 repositories & AWS Account
AWS CI User Credentials with Administration ...
1
vote
0
answers
46
views
Google SAML auth not working through APP tile but works with direct link
We've recently migrated from Okta to Google for work for AWS authentication.
Our amazon org authentication is setup through IAM Identity center. It was working flawlessly using Okta but since we ...
- 111
0
votes
0
answers
100
views
AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment
Let's say we produce IoT devices and want them to access AWS IoT Core.
The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
- 101
2
votes
0
answers
125
views
How are companies automatically rotating secrets such as API keys?
We currently rotate AWS-specific secrets via AWS Secrets Manager without much issue. However, we are looking to also rotate secrets e.g. API keys for specific services, but AWS Secrets Manager does ...
- 121
1
vote
1
answer
168
views
Why is ip forwarding for a ECS instance being flagged as a vulnerability?
I am very new to this and was asked to address some security patches on various ec2 instances in our AWS account. Mostly this was a matter of using the Security Manager to connect to the instance and ...
- 21
0
votes
0
answers
112
views
Risk for a public RDS database on AWS
I have a RDS database on a VPC which is public with a password.
I have some lambda functions (that are not in a VPC) that communicates with this database. To be able to do that I had to modify the ...
- 1
3
votes
1
answer
555
views
How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?
Problem
Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*.
...
- 33
0
votes
0
answers
88
views
Is it risky to include .env files in the .zip which is uploaded to Elastic Beanstalk for deployment? If so, what is the risk?
Is it okay to upload .env files containing client ID and client secret to elastic beanstalk? If not, what is the risk involved? How would one access those files?
- 123
2
votes
1
answer
777
views
Public client or Confidential client: should I generate a client secret?
I've read about this but I don't fully understand how to choose.
I have two options:
Public client
"A native, browser or mobile-device app. Cognito API requests are made from user systems that ...
- 123
0
votes
1
answer
141
views
Does using Apache/nginx actually improve security of a webapp?
Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the ...
- 123
1
vote
0
answers
94
views
Prevention of access to user data running on the cloud
I am building a web-based software as a service (SaaS) platform for engineering simulations that run on the cloud, and wish to prevent my access to user data by design. The user designs a 3D geometry (...
- 129
5
votes
2
answers
220
views
Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers
We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
- 63
2
votes
0
answers
145
views
Using API key as public key and IP address as private key to WASM application
I'm trying to offer a service to users that allows them to write Python via pyodide or R code via webR in their browser against my own data. I've been thinking of ways to go about this and I'm curious ...
- 21
1
vote
1
answer
456
views
Explanation of the AWS IAM PassRole vulnerability
Help me understand what the risk in the AWS Privilege Escalation Vulnerabilities article is.
I think it is normal that I create an EC2 instance and associate an IAM role as its instance profile, and ...
- 295
7
votes
1
answer
10k
views
Understanding ssh-rsa not in PubkeyAcceptedAlgorithms
I am having problem in connecting to an Amazon EC2 Linux instance from an old Mac OS machine running El Capitan. Unfortunately without any possibility to upgrade the OS.
Because all the other modern ...
- 173
1
vote
2
answers
3k
views
AWS RDS Database access from Github Actions
I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS.
The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
- 111
1
vote
1
answer
499
views
Should an AWS Lambda trust-policy be narrowly scoped?
Should trust policies for AWS Lambda be narrowly scoped, and how can this be implemented (e.g. using Terraform)?
Using Terraform I ran into a cyclic dependency problem as follows: an AWS Lambda ...
- 165
2
votes
0
answers
73
views
AWS sub-accounts to protect against deletion of versioned data in S3
How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
- 165
1
vote
1
answer
102
views
Is my Jupyter notebook on EC2 secure?
I have a product I am making available to some users that runs via a Jupyter notebook. I deploy Jupyter inside of a docker container to an EC2 host. Each user gets an instance I'll send to them. For ...
- 115
1
vote
1
answer
156
views
Is handling keys with vps without kms secure?
I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the ...
- 141
0
votes
0
answers
484
views
Why am I able to access EC2 metadata endpoint from within a Docker container running in the EC2
My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether ...
- 1,522
0
votes
1
answer
207
views
Confidential Computing - SQL Server Always Encrypted w/ Secure Enclave - Customer Managed Keys or alternative
I am looking into ways to build a data warehouse that would house confidential data for 1+ clients. The requirement is that our organization can never obtain access to the decrypted data. There would ...
- 101
0
votes
1
answer
288
views
Understanding AWS/KMS Keyring Encryption, Genkeys and Plaintext Data Keys
I'm reading up on the AWS Encryption SDK (JavaScript flavor but this is the same for Python and Java, and my question is really on the underlying security principles, which are language agnostic). On ...
- 347
0
votes
1
answer
1k
views
Is using route 53 from AWS sufficient for DDOS protection on DNS level, or do you need to combine it with other AWS products
We have been targeted by DNS DDOS attacks. We have now migrated to AWS Route53 as these DNS servers are more resilient.
Is using AWS Route 53 enough to have basic DDOS protection? Or is it necessary ...
- 101
1
vote
1
answer
238
views
Using AWS System Manager Parameter Store SecureString in config file in ec2
On an ec2 box I am running a service that reads vars from a config file. One var's value is stored in AWS System Manager as a SecureString. I want to use that value in the text file securely.
I can ...
- 11
0
votes
1
answer
123
views
e-signature + digital signature aws md5
I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents.
My question are:
Is MD5 (...
0
votes
1
answer
430
views
After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?
I have a private S3 bucket. I want a user from an external organisation to have access.
I have added a user in IAM. How does this external user get notified and how do I share credentials?
The secret ...
- 671
0
votes
2
answers
257
views
Does AWS security group block unintentionally exposed ports from Docker?
My typical cloud server hardening includes blocking ports at the UFW level on the server as well as at the AWS security group level.
I recently learned that Docker overwrites your IPTables. Given that,...
- 121
0
votes
1
answer
165
views
Is someone trying to attack our API
I created a service with elastic beanstalk in AWS 2 or 3 hours ago.
EC2 is in private subnet and load balancer is in public subnet.
When I look to logs I saw these requests.
What are they?
- 3
0
votes
1
answer
812
views
What is the intent behind these unknown HTTP Requests into my AWS Web Server?
I know about the usual port sniffers and mass scanners that just pop up on any web server, but this one looks interesting to me.
I figured out so far that those requests aren't really an issue for my ...
- 339
0
votes
2
answers
110
views
Would the TCP port of a VPN with access to the VPC be considered as a "Server administration port" in CIS benchmark?
I'm deploying an AWS Infrastructure that should adhere the CIS Benchmark.
I'm trying to understand if the TCP port of the VPN server that permits access to the VPC has to be considered as a "...
- 111
2
votes
2
answers
216
views
Do CloudFront edges talk to custom origins over open (non-AWS) networks?
Where the custom origin server for an AWS CloudFront distribution is an EC2 instance accessible with a public DNS record, do CloudFront edge locations talk to it over the open Internet — as opposed to ...
- 768
0
votes
1
answer
147
views
How to know if an Amazon AWS server is safe or not?
I see connections to Amazon AWS servers, and since everyone can register servers on Amazon, how do I know if my PC communicating with a safe Amazon server, or with a server which a hacker registered?
...
- 39
1
vote
1
answer
335
views
Can the services inside the VPC be authentication less?
We have a micro-services architecture, where many microservers need to talk to each other for data.
These services are inside a VPC.
I need to understand if the HTTP APIs of these microservices need ...
0
votes
2
answers
293
views
Docker, running programs as Root and AWS
It is well known that running programs inside your docker container as root is bad practice. As far as I can tell, the reason for this is because root on the container is rather similar to root on the ...
- 101
0
votes
1
answer
526
views
AWS Service-To-Service authentication via Identity document
In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
- 121
0
votes
1
answer
2k
views
SCP to create security groups in member AWS account
I'm trying to create a SCP to restrict member account users to create/modify security group(s) that have inbound rule for SSH/RDP with Source set as 0.0.0.0 or ::/0.
Basically, I want users to SSH ...
- 525
0
votes
1
answer
170
views
what is benefit of using KMS to "encrypt" between two AWS users, instead of just sending directly through AWS?
I am just learning KMS and how granting encrypt/decrypt permissions on KMS keys works, but I don't understand what is the benefit of using KMS to encrypt data to send to another AWS customer, who then ...
- 653
1
vote
1
answer
768
views
Why do I need an IDS/IPS in a serverless cloud environment?
Following this question (Why do we need IDS/IPS if a firewall is present?) from a few years back, I am trying to take this subject to the cloud.
Assuming that I have a fully "serverless" AWS ...
- 111
1
vote
1
answer
167
views
Can I escalate my privileges if I have read-write access to IAM service in AWS?
We are trying to convince folks in our company to grant developers full privileges to all services in "dev" account (current policy does not allow developers to create anything in our AWS ...
- 113
0
votes
0
answers
127
views
AWS IAM Access Issue
We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or ...
1
vote
2
answers
126
views
Securely storing password and encryption key on AWS
I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an ...
- 131