Questions tagged [aws]
Amazon Web Services (AWS) are a set of cloud services offered by Amazon.
274
questions
0
votes
0
answers
10
views
How to connect to AWS VPN from a country that blocks most VPNs [migrated]
For work, I must connect to AWS cloud services via the AWS VPN app that my company setup on the company laptop that I use. The AWS VPN only provides access to my company's space in AWS (EC2, S3, ...
- 101
0
votes
0
answers
21
views
Is it risky to include .env files in the .zip which is uploaded to Elastic Beanstalk for deployment? If so, what is the risk?
Is it okay to upload .env files containing client ID and client secret to elastic beanstalk? If not, what is the risk involved? How would one access those files?
- 113
1
vote
1
answer
90
views
Public client or Confidential client: should I generate a client secret?
I've read about this but I don't fully understand how to choose.
I have two options:
Public client
"A native, browser or mobile-device app. Cognito API requests are made from user systems that ...
- 113
0
votes
1
answer
48
views
Does using Apache/nginx actually improve security of a webapp?
Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the ...
- 113
1
vote
0
answers
46
views
Prevention of access to user data running on the cloud
I am building a web-based software as a service (SaaS) platform for engineering simulations that run on the cloud, and wish to prevent my access to user data by design. The user designs a 3D geometry (...
- 129
5
votes
2
answers
141
views
Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers
We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
- 53
1
vote
0
answers
53
views
Using API key as public key and IP address as private key to WASM application
I'm trying to offer a service to users that allows them to write Python via pyodide or R code via webR in their browser against my own data. I've been thinking of ways to go about this and I'm curious ...
- 11
1
vote
1
answer
186
views
Explanation of the AWS IAM PassRole vulnerability
Help me understand what the risk in the AWS Privilege Escalation Vulnerabilities article is.
I think it is normal that I create an EC2 instance and associate an IAM role as its instance profile, and ...
- 295
5
votes
1
answer
3k
views
Understanding ssh-rsa not in PubkeyAcceptedAlgorithms
I am having problem in connecting to an Amazon EC2 Linux instance from an old Mac OS machine running El Capitan. Unfortunately without any possibility to upgrade the OS.
Because all the other modern ...
- 153
1
vote
1
answer
1k
views
AWS RDS Database access from Github Actions
I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS.
The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
- 111
1
vote
1
answer
255
views
Should an AWS Lambda trust-policy be narrowly scoped?
Should trust policies for AWS Lambda be narrowly scoped, and how can this be implemented (e.g. using Terraform)?
Using Terraform I ran into a cyclic dependency problem as follows: an AWS Lambda ...
- 135
2
votes
0
answers
30
views
AWS sub-accounts to protect against deletion of versioned data in S3
How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
- 135
0
votes
0
answers
41
views
Is is bad that on-prem "prod" DB is accessible/visible from in-cloud dev environment?
We have our dev & prod env split between AWS (databricks workspaces) and on-prem Linux boxes. Specifically, we have DB instances on-prem and have python code running inside our databricks ...
- 113
1
vote
1
answer
49
views
Is my Jupyter notebook on EC2 secure?
I have a product I am making available to some users that runs via a Jupyter notebook. I deploy Jupyter inside of a docker container to an EC2 host. Each user gets an instance I'll send to them. For ...
- 115
1
vote
1
answer
96
views
Is handling keys with vps without kms secure?
I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the ...
- 141
0
votes
0
answers
265
views
Why am I able to access EC2 metadata endpoint from within a Docker container running in the EC2
My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether ...
- 1,522
0
votes
1
answer
118
views
Confidential Computing - SQL Server Always Encrypted w/ Secure Enclave - Customer Managed Keys or alternative
I am looking into ways to build a data warehouse that would house confidential data for 1+ clients. The requirement is that our organization can never obtain access to the decrypted data. There would ...
- 101
0
votes
1
answer
117
views
Understanding AWS/KMS Keyring Encryption, Genkeys and Plaintext Data Keys
I'm reading up on the AWS Encryption SDK (JavaScript flavor but this is the same for Python and Java, and my question is really on the underlying security principles, which are language agnostic). On ...
- 337
0
votes
1
answer
858
views
Is using route 53 from AWS sufficient for DDOS protection on DNS level, or do you need to combine it with other AWS products
We have been targeted by DNS DDOS attacks. We have now migrated to AWS Route53 as these DNS servers are more resilient.
Is using AWS Route 53 enough to have basic DDOS protection? Or is it necessary ...
- 101
1
vote
1
answer
131
views
Using AWS System Manager Parameter Store SecureString in config file in ec2
On an ec2 box I am running a service that reads vars from a config file. One var's value is stored in AWS System Manager as a SecureString. I want to use that value in the text file securely.
I can ...
- 11
0
votes
1
answer
60
views
e-signature + digital signature aws md5
I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents.
My question are:
Is MD5 (...
0
votes
1
answer
228
views
After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?
I have a private S3 bucket. I want a user from an external organisation to have access.
I have added a user in IAM. How does this external user get notified and how do I share credentials?
The secret ...
- 651
0
votes
2
answers
166
views
Does AWS security group block unintentionally exposed ports from Docker?
My typical cloud server hardening includes blocking ports at the UFW level on the server as well as at the AWS security group level.
I recently learned that Docker overwrites your IPTables. Given that,...
- 101
0
votes
1
answer
122
views
Is someone trying to attack our API
I created a service with elastic beanstalk in AWS 2 or 3 hours ago.
EC2 is in private subnet and load balancer is in public subnet.
When I look to logs I saw these requests.
What are they?
- 3
0
votes
1
answer
515
views
What is the intent behind these unknown HTTP Requests into my AWS Web Server?
I know about the usual port sniffers and mass scanners that just pop up on any web server, but this one looks interesting to me.
I figured out so far that those requests aren't really an issue for my ...
- 319
0
votes
2
answers
67
views
Would the TCP port of a VPN with access to the VPC be considered as a "Server administration port" in CIS benchmark?
I'm deploying an AWS Infrastructure that should adhere the CIS Benchmark.
I'm trying to understand if the TCP port of the VPN server that permits access to the VPC has to be considered as a "...
- 111
2
votes
2
answers
135
views
Do CloudFront edges talk to custom origins over open (non-AWS) networks?
Where the custom origin server for an AWS CloudFront distribution is an EC2 instance accessible with a public DNS record, do CloudFront edge locations talk to it over the open Internet — as opposed to ...
- 768
0
votes
1
answer
102
views
How to know if an Amazon AWS server is safe or not?
I see connections to Amazon AWS servers, and since everyone can register servers on Amazon, how do I know if my PC communicating with a safe Amazon server, or with a server which a hacker registered?
...
- 39
1
vote
1
answer
229
views
Can the services inside the VPC be authentication less?
We have a micro-services architecture, where many microservers need to talk to each other for data.
These services are inside a VPC.
I need to understand if the HTTP APIs of these microservices need ...
0
votes
2
answers
189
views
Docker, running programs as Root and AWS
It is well known that running programs inside your docker container as root is bad practice. As far as I can tell, the reason for this is because root on the container is rather similar to root on the ...
- 101
0
votes
1
answer
390
views
AWS Service-To-Service authentication via Identity document
In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
- 31
0
votes
1
answer
1k
views
SCP to create security groups in member AWS account
I'm trying to create a SCP to restrict member account users to create/modify security group(s) that have inbound rule for SSH/RDP with Source set as 0.0.0.0 or ::/0.
Basically, I want users to SSH ...
- 525
0
votes
1
answer
86
views
what is benefit of using KMS to "encrypt" between two AWS users, instead of just sending directly through AWS?
I am just learning KMS and how granting encrypt/decrypt permissions on KMS keys works, but I don't understand what is the benefit of using KMS to encrypt data to send to another AWS customer, who then ...
- 643
1
vote
1
answer
512
views
Why do I need an IDS/IPS in a serverless cloud environment?
Following this question (Why do we need IDS/IPS if a firewall is present?) from a few years back, I am trying to take this subject to the cloud.
Assuming that I have a fully "serverless" AWS ...
- 111
1
vote
1
answer
114
views
Can I escalate my privileges if I have read-write access to IAM service in AWS?
We are trying to convince folks in our company to grant developers full privileges to all services in "dev" account (current policy does not allow developers to create anything in our AWS ...
- 113
0
votes
0
answers
77
views
AWS IAM Access Issue
We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or ...
1
vote
2
answers
88
views
Securely storing password and encryption key on AWS
I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an ...
- 121
2
votes
2
answers
71
views
Security Concern Opening Up Azure VM to AWS IPs
We have an IIS webserver hosted in Azure. We want to monitor this server via our cloud SIEM hosted in AWS. To monitor, there is a requirement to open outbound 443, on the VM, to a few hundred AWS ...
- 133
2
votes
1
answer
324
views
Is SSL on AWS RDS in private network necessary
I saw that using SSL on AWS RDS can reduce the performance of the database by over 10%. Let's say that an RDS database is on a private network and only accessed by applications on other private ...
- 23
0
votes
1
answer
209
views
ec2 instance insecure to allow ssh to any ip address
I have a linux instance deployed on AWS EC2.
Sorry for my dumb question, but I'll ask anyways just to be safe.
Q1. While creating an instance, I set anyone 0.0.0.0:0 for the ssh. Though, on the next ...
- 105
1
vote
1
answer
1k
views
Should we enable UFW for EC2 (Ubuntu Server) instance with Nginx?
I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal.
I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message.
It's not a big ...
- 13
2
votes
0
answers
300
views
All private subdomains found and listed, including those from my home IP
It's been my understanding in the past years that it's not easily possible to find out all the subdomains of a domain (unless these are used publicly, like in hyperlinks, etc), and likewise not easily ...
- 215
1
vote
1
answer
942
views
Where could we get CIS Hardening Scripts for AWS EC2?
CIS has published hardening standards for all operating systems of EC2 in AWS.
CIS also provides hardened images as well but they're quite expensive at $130/year/instance.
Is there a place where we ...
- 113
5
votes
0
answers
8k
views
What does a POST like 0x%5B%5D=somename try to achieve?
We created a default environment on AWS Elastic Beanstalk using their Python "sample app". After some time, the logs show a large number of POST requests with bodies like this:
b'0x%5B%5D=...
- 463
0
votes
1
answer
219
views
Purpose of fraudulent AWS SL/TLS certificate request for my domain
I just received an email from AWS re Certificate request for [my personal domain].
This email asked me to approve this request with a link or forward to a AWS email for validation.
Needless to say ...
- 101
2
votes
1
answer
259
views
Not the same password for AWS (root user) and Amazon.com shopping, because that is not secure in my eyes
I use the same email address for the AWS root user and my Amazon shopping account.
Unfortunately the password for both parts of Amazon is also the same, when I change the AWS password I automatically ...
- 1,445
1
vote
2
answers
341
views
How to manage Encryption Key for Server Side Encryption in AWS S3
I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows:
All the existing data ...
- 11
1
vote
1
answer
2k
views
Are weak cipher suites for TLS1.2 a valid concern?
I have an API hosted on Amazon API Gateway. When running a security scan of it using https://www.ssllabs.com/ it reports back warnings concerning weak cipher suites for TLS 1.2 (see below).
Are these ...
- 113
2
votes
3
answers
436
views
Is it more or less secure to use IAM (AWS user management) if you only have one user?
This is an edge case, and as soon as multiple users are accessing the AWS Console in anyway, IAM is the only good option, but what if you only have one user?
I've always assumed that if only one ...
- 376
1
vote
0
answers
439
views
AWS KMS CMK compromise
Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
- 682