Skip to main content

Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

54 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
3 answers
344 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
Master_Yoda's user avatar
3 votes
0 answers
210 views

concatenation vs multiple rounds of HMAC

I was studying the AWS request signature process and found that they derive the signing key from multiple sources (one and two related questions). Specifically this: kSecret = Your AWS Secret Access ...
Marcelo MD's user avatar
3 votes
0 answers
149 views

AWS SSM Agent protection

Our company is moving to the AWS cloud recently, and AWS relies a lot on the SSM agent, it is also opensource. ( https://github.com/aws/amazon-ssm-agent ) From my understanding, this agent is not ...
user avatar
2 votes
0 answers
119 views

How are companies automatically rotating secrets such as API keys?

We currently rotate AWS-specific secrets via AWS Secrets Manager without much issue. However, we are looking to also rotate secrets e.g. API keys for specific services, but AWS Secrets Manager does ...
Wunderbread's user avatar
2 votes
0 answers
132 views

Using API key as public key and IP address as private key to WASM application

I'm trying to offer a service to users that allows them to write Python via pyodide or R code via webR in their browser against my own data. I've been thinking of ways to go about this and I'm curious ...
S3AN556's user avatar
  • 21
2 votes
0 answers
72 views

AWS sub-accounts to protect against deletion of versioned data in S3

How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
benjimin's user avatar
  • 165
2 votes
2 answers
114 views

Security Concern Opening Up Azure VM to AWS IPs

We have an IIS webserver hosted in Azure. We want to monitor this server via our cloud SIEM hosted in AWS. To monitor, there is a requirement to open outbound 443, on the VM, to a few hundred AWS ...
Nina G's user avatar
  • 133
2 votes
0 answers
459 views

All private subdomains found and listed, including those from my home IP

It's been my understanding in the past years that it's not easily possible to find out all the subdomains of a domain (unless these are used publicly, like in hyperlinks, etc), and likewise not easily ...
Nuno's user avatar
  • 215
2 votes
0 answers
1k views

Using Google Authentication with Lambda@Edge and S3 Static Sites

I am looking to set up authentication on an S3 hosted static site. The configuration is: S3 bucket configured to allow access via cloudfront AWS Cloudfront distribution with HTTPS configured and a ...
mibr's user avatar
  • 166
2 votes
1 answer
605 views

How secure is SSL private key in AWS ELB service?

We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
Vlad Nikiforov's user avatar
2 votes
0 answers
5k views

SNI and hostname provided via HTTP are different error

I am using Apache 2.2 webserver on ubuntu Aws instance. My website goes down with below errors on error log, [ssl:error] [pid 46283] AH02032: Hostname provided via SNI and hostname provided via ...
adminz's user avatar
  • 145
1 vote
0 answers
23 views

How to manage temporary AWS credentials for on-premises Kubernetes clusters?

We have several on-premises Kubernetes clusters that need to utilize AWS services. Currently, we use traditional IAM Users with static credentials, but we recognize this is a bad practice. We want to ...
Catriel Goodman's user avatar
1 vote
0 answers
41 views

Google SAML auth not working through APP tile but works with direct link

We've recently migrated from Okta to Google for work for AWS authentication. Our amazon org authentication is setup through IAM Identity center. It was working flawlessly using Okta but since we ...
JeanneD4RK's user avatar
1 vote
0 answers
91 views

Prevention of access to user data running on the cloud

I am building a web-based software as a service (SaaS) platform for engineering simulations that run on the cloud, and wish to prevent my access to user data by design. The user designs a 3D geometry (...
Coto TheArcher's user avatar
1 vote
1 answer
226 views

Using AWS System Manager Parameter Store SecureString in config file in ec2

On an ec2 box I am running a service that reads vars from a config file. One var's value is stored in AWS System Manager as a SecureString. I want to use that value in the text file securely. I can ...
halfcrud6sad's user avatar
1 vote
2 answers
417 views

How to manage Encryption Key for Server Side Encryption in AWS S3

I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows: All the existing data ...
abhishekti7's user avatar
1 vote
0 answers
109 views

How to provide | revoke access to an AWS machine without going through the AWS console

Assuming if you do via SSH (which is shared among multiple team members), how to manage this from a security perspective or should each user be given a separate SSH key
Rpj's user avatar
  • 111
1 vote
0 answers
105 views

Is there record of a pubilc RDS instance with strong password having been hacked?

I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet However, the instance has a relatively strong ...
Matias Haeussler's user avatar
1 vote
0 answers
513 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
nikel's user avatar
  • 111
1 vote
0 answers
119 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
false_azure's user avatar
1 vote
0 answers
394 views

Is the example Amazon SNS Topic Policy for CloudTrail too permissive?

I'm trying to configure several AWS accounts to log CloudTrail to a central logging account, from which the logs will be brought into Splunk. In order to do this, I need to configure CloudTrail on ...
Joe M.'s user avatar
  • 449
1 vote
0 answers
288 views

Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS

I'm a bit new to coding backend services. And I'm not sure how to solve this problem. So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
Davidhall's user avatar
1 vote
0 answers
174 views

What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?

I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
Chev_603's user avatar
  • 256
1 vote
0 answers
138 views

What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?

When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2. I have gone ...
Azaam Alfi's user avatar
1 vote
0 answers
110 views

Are there any additional security precautions I can or should take with my service?

Suppose I'm building a service to store all the secure or sensitive information that my other applications use. Think passwords, or private SSH keys. Under the old programming paradigm of 'do one ...
CGriffin's user avatar
  • 111
1 vote
0 answers
389 views

GDPR compliance in Amazon AWS

Anybody has a nice checklist/todo list to achieve GDPR compliance in Amazon AWS environments? Want to use dev-sec.io checklists, OWASP for web app, AWS Trusted Advisor. Anything else to include/...
dev's user avatar
  • 997
1 vote
0 answers
663 views

How is SSL encryption maintained between AWS CloudFront and EC2?

So I recently set up an API on an AWS EC2 instance. To be able to serve responses over HTTPS I used Route 53 to redirect my custom domain to a CloudFront distribution which points to the EC2 instance. ...
theasianpianist's user avatar
0 votes
0 answers
30 views

can non-rotatable secrets be stored in ciphertext form in a DB/file/etc.?

We have a service running on AWS. This service uses secrets such as API keys of third party services (in other words: secrets which do not rotate automatically). These secrets are stored in AWS ...
Itay Maman's user avatar
0 votes
0 answers
75 views

AWS Key stolen out of Github Actions / Secret Store

Do you have an idea how my AWS credentials could be stolen in the following setup: A 4 weeks old GitHub organization with 5 repositories & AWS Account AWS CI User Credentials with Administration ...
user1845948's user avatar
0 votes
0 answers
95 views

AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment

Let's say we produce IoT devices and want them to access AWS IoT Core. The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
Francesco B.'s user avatar
0 votes
0 answers
94 views

Risk for a public RDS database on AWS

I have a RDS database on a VPC which is public with a password. I have some lambda functions (that are not in a VPC) that communicates with this database. To be able to do that I had to modify the ...
JVanced's user avatar
0 votes
0 answers
82 views

Is it risky to include .env files in the .zip which is uploaded to Elastic Beanstalk for deployment? If so, what is the risk?

Is it okay to upload .env files containing client ID and client secret to elastic beanstalk? If not, what is the risk involved? How would one access those files?
BigMistake's user avatar
0 votes
0 answers
464 views

Why am I able to access EC2 metadata endpoint from within a Docker container running in the EC2

My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether ...
qre0ct's user avatar
  • 1,522
0 votes
1 answer
117 views

e-signature + digital signature aws md5

I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents. My question are: Is MD5 (...
user286122's user avatar
0 votes
1 answer
411 views

After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?

I have a private S3 bucket. I want a user from an external organisation to have access. I have added a user in IAM. How does this external user get notified and how do I share credentials? The secret ...
Architect 's user avatar
0 votes
1 answer
512 views

AWS Service-To-Service authentication via Identity document

In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
anon2328's user avatar
  • 121
0 votes
0 answers
121 views

AWS IAM Access Issue

We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or ...
samtech 2021's user avatar
0 votes
1 answer
1k views

How do I get a forensic copy of an EC2 server?

Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
cyberf0rensicsx's user avatar
0 votes
0 answers
235 views

A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority

I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS. My public web domain is ...
Alejandro Cortizo's user avatar
0 votes
0 answers
853 views

OpenVPN client suddenly refuses to connect to my self-hosted VPN

It's been working fine for years, but now suddenly I'm getting a strange error. Does anyone know what problem this points to? OpenVPN Connect Version 3.0.2 (598), error logs: [REDACTED IPs] 5/16/2021,...
knutole's user avatar
  • 121
0 votes
1 answer
1k views

Isolation AWS resources with multiple subnets vs multiple VPCs

I have AWS resources (e.g. EC2s, RDS instances) that I would like to isolate from each other so that if one is compromised, the potential damage is limited. I am most concerned about data leakage / ...
sdgfsdh's user avatar
  • 158
0 votes
0 answers
150 views

How does AWS verify signed requests?

How does AWS request signing and verification work? Let's say I have created a signed request using this guide. How does AWS service verify this signature? I see 2 options with their respective flaws (...
user32569's user avatar
  • 101
0 votes
0 answers
137 views

KMS Key Exposure

I've found some KMS key exposed in some code and am wondering what exactly the severity would be. What could an attacker achieve by having this key?
Hysii's user avatar
  • 199
0 votes
0 answers
111 views

Naming AWS resources

For S3 bucket names, anyone can query a bucket name (without specifying an account owner) and see if the bucket is misconfigured to allow public access. Therefore, it arguably makes sense to use a ...
octothorpe_not_hashtag's user avatar
0 votes
1 answer
309 views

AWS IAM policies that differentiate between console & access key access

Question: How can an AWS IAM policy be devised to differentiate between a console (web) and access key (API) access? Use Case: Say, I want to allow the a certain group of users full IAM privileges ...
Alex's user avatar
  • 1
0 votes
0 answers
119 views

Inverse of Third Party Authentication

Consider this scenario. I have a file hosted on AWS with private access. I want the file to be accessible to several authorized users of a web applicaton that I have built. As I am the one ...
rohit-biswas's user avatar
0 votes
0 answers
267 views

Is it secure to rely on the data in a lambda context authorizer claims?

I am working on lambda authorization and I learned that there are generally two options. Either use the default authorizer on the API gateway level, which will do all the heavy lifting (validate the ...
Roy Ca's user avatar
  • 141
0 votes
0 answers
107 views

How can I give a network load balancer (of any type) access to a port on a machine without opening that port to an entire VPC?

Is it possible to make an AWS load balancer for a non-HTTP port allowed to access a specific port on a host without opening that port open to the entire VPC's subnet? I seem to remember reading that ...
Some Linux Nerd's user avatar
0 votes
0 answers
89 views

Is Bucket Upload Policy a good pratice for upload files to AWS S3?

In AWS docs page has the following instructions to upload files to an AWS bucket from browser: https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html This solution send to browser a ...
Vivi's user avatar
  • 69
0 votes
1 answer
498 views

Are AWS security groups enough to segment network and reduce PCI scope?

I was reading this paper https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf It shows this image Am I correct in saying that - as long as instances have proper security groups that ...
Sim's user avatar
  • 173