Questions tagged [aws]
Amazon Web Services (AWS) are a set of cloud services offered by Amazon.
52
questions with no upvoted or accepted answers
5
votes
0
answers
8k
views
What does a POST like 0x%5B%5D=somename try to achieve?
We created a default environment on AWS Elastic Beanstalk using their Python "sample app". After some time, the logs show a large number of POST requests with bodies like this:
b'0x%5B%5D=...
- 463
5
votes
3
answers
300
views
How can one centrally manage / audit AWS resource-based policies
An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
- 151
3
votes
0
answers
180
views
concatenation vs multiple rounds of HMAC
I was studying the AWS request signature process and found that they derive the signing key from multiple sources (one and two related questions).
Specifically this:
kSecret = Your AWS Secret Access ...
- 131
3
votes
0
answers
125
views
AWS SSM Agent protection
Our company is moving to the AWS cloud recently, and AWS relies a lot on the SSM agent, it is also opensource. ( https://github.com/aws/amazon-ssm-agent )
From my understanding, this agent is not ...
user50312
2
votes
0
answers
31
views
AWS sub-accounts to protect against deletion of versioned data in S3
How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
- 135
2
votes
2
answers
72
views
Security Concern Opening Up Azure VM to AWS IPs
We have an IIS webserver hosted in Azure. We want to monitor this server via our cloud SIEM hosted in AWS. To monitor, there is a requirement to open outbound 443, on the VM, to a few hundred AWS ...
- 133
2
votes
0
answers
307
views
All private subdomains found and listed, including those from my home IP
It's been my understanding in the past years that it's not easily possible to find out all the subdomains of a domain (unless these are used publicly, like in hyperlinks, etc), and likewise not easily ...
- 215
2
votes
3
answers
1k
views
Making S3 objects viewable only for logged in users
As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve ...
- 21
2
votes
0
answers
1k
views
Using Google Authentication with Lambda@Edge and S3 Static Sites
I am looking to set up authentication on an S3 hosted static site. The configuration is:
S3 bucket configured to allow access via cloudfront
AWS Cloudfront distribution with HTTPS configured and a ...
- 166
2
votes
0
answers
5k
views
SNI and hostname provided via HTTP are different error
I am using Apache 2.2 webserver on ubuntu Aws instance. My website goes down with below errors on error log,
[ssl:error] [pid 46283] AH02032: Hostname provided via SNI and hostname provided via ...
- 135
1
vote
0
answers
47
views
Prevention of access to user data running on the cloud
I am building a web-based software as a service (SaaS) platform for engineering simulations that run on the cloud, and wish to prevent my access to user data by design. The user designs a 3D geometry (...
- 129
1
vote
0
answers
55
views
Using API key as public key and IP address as private key to WASM application
I'm trying to offer a service to users that allows them to write Python via pyodide or R code via webR in their browser against my own data. I've been thinking of ways to go about this and I'm curious ...
- 11
1
vote
1
answer
134
views
Using AWS System Manager Parameter Store SecureString in config file in ec2
On an ec2 box I am running a service that reads vars from a config file. One var's value is stored in AWS System Manager as a SecureString. I want to use that value in the text file securely.
I can ...
- 11
1
vote
2
answers
342
views
How to manage Encryption Key for Server Side Encryption in AWS S3
I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows:
All the existing data ...
- 11
1
vote
0
answers
442
views
AWS KMS CMK compromise
Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
- 682
1
vote
0
answers
77
views
How to provide | revoke access to an AWS machine without going through the AWS console
Assuming if you do via SSH (which is shared among multiple team members), how to manage this from a security perspective or should each user be given a separate SSH key
- 111
1
vote
0
answers
79
views
Is there record of a pubilc RDS instance with strong password having been hacked?
I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet
However, the instance has a relatively strong ...
- 153
1
vote
0
answers
458
views
AWS Appsync authorization - why is IAM authorization safer than API Key based approach
We are currently evaluating which authorization type to use for our production AppSync APIs.
As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
- 111
1
vote
0
answers
96
views
'Hard-to-guess' custom header (or similar) to whitelist via a firewall
My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services.
We thought of doing ...
- 111
1
vote
0
answers
336
views
Is the example Amazon SNS Topic Policy for CloudTrail too permissive?
I'm trying to configure several AWS accounts to log CloudTrail to a central logging account, from which the logs will be brought into Splunk. In order to do this, I need to configure CloudTrail on ...
- 439
1
vote
0
answers
244
views
Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS
I'm a bit new to coding backend services. And I'm not sure how to solve this problem.
So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
- 11
1
vote
0
answers
146
views
What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?
I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
- 256
1
vote
1
answer
530
views
How secure is SSL private key in AWS ELB service?
We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
- 2,023
1
vote
0
answers
113
views
What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?
When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2.
I have gone ...
- 23
1
vote
0
answers
86
views
Are there any additional security precautions I can or should take with my service?
Suppose I'm building a service to store all the secure or sensitive information that my other applications use. Think passwords, or private SSH keys. Under the old programming paradigm of 'do one ...
- 111
1
vote
0
answers
352
views
GDPR compliance in Amazon AWS
Anybody has a nice checklist/todo list to achieve GDPR compliance in Amazon AWS environments? Want to use dev-sec.io checklists, OWASP for web app, AWS Trusted Advisor. Anything else to include/...
- 977
1
vote
0
answers
627
views
How is SSL encryption maintained between AWS CloudFront and EC2?
So I recently set up an API on an AWS EC2 instance. To be able to serve responses over HTTPS I used Route 53 to redirect my custom domain to a CloudFront distribution which points to the EC2 instance. ...
- 119
0
votes
0
answers
23
views
Is it risky to include .env files in the .zip which is uploaded to Elastic Beanstalk for deployment? If so, what is the risk?
Is it okay to upload .env files containing client ID and client secret to elastic beanstalk? If not, what is the risk involved? How would one access those files?
- 113
0
votes
0
answers
43
views
Is is bad that on-prem "prod" DB is accessible/visible from in-cloud dev environment?
We have our dev & prod env split between AWS (databricks workspaces) and on-prem Linux boxes. Specifically, we have DB instances on-prem and have python code running inside our databricks ...
- 113
0
votes
0
answers
275
views
Why am I able to access EC2 metadata endpoint from within a Docker container running in the EC2
My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether ...
- 1,522
0
votes
1
answer
62
views
e-signature + digital signature aws md5
I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents.
My question are:
Is MD5 (...
0
votes
1
answer
239
views
After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?
I have a private S3 bucket. I want a user from an external organisation to have access.
I have added a user in IAM. How does this external user get notified and how do I share credentials?
The secret ...
- 651
0
votes
1
answer
403
views
AWS Service-To-Service authentication via Identity document
In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
- 31
0
votes
0
answers
78
views
AWS IAM Access Issue
We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or ...
0
votes
1
answer
850
views
How do I get a forensic copy of an EC2 server?
Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
0
votes
0
answers
182
views
A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority
I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS.
My public web domain is ...
0
votes
0
answers
730
views
OpenVPN client suddenly refuses to connect to my self-hosted VPN
It's been working fine for years, but now suddenly I'm getting a strange error. Does anyone know what problem this points to?
OpenVPN Connect Version 3.0.2 (598), error logs:
[REDACTED IPs]
5/16/2021,...
- 121
0
votes
1
answer
816
views
Isolation AWS resources with multiple subnets vs multiple VPCs
I have AWS resources (e.g. EC2s, RDS instances) that I would like to isolate from each other so that if one is compromised, the potential damage is limited. I am most concerned about data leakage / ...
- 158
0
votes
0
answers
114
views
How does AWS verify signed requests?
How does AWS request signing and verification work? Let's say I have created a signed request using this guide.
How does AWS service verify this signature? I see 2 options with their respective flaws (...
- 101
0
votes
0
answers
108
views
KMS Key Exposure
I've found some KMS key exposed in some code and am wondering what exactly the severity would be.
What could an attacker achieve by having this key?
- 189
0
votes
0
answers
86
views
Naming AWS resources
For S3 bucket names, anyone can query a bucket name (without specifying an account owner) and see if the bucket is misconfigured to allow public access.
Therefore, it arguably makes sense to use a ...
0
votes
0
answers
142
views
WAF really Needed?
I'm running a company web application in AWS. This web app is behind a cognito+External Identity provider with SAML for only allowing company employees to reach the app (then they log in with local ...
0
votes
1
answer
240
views
AWS IAM policies that differentiate between console & access key access
Question:
How can an AWS IAM policy be devised to differentiate between a console (web) and access key (API) access?
Use Case:
Say, I want to allow the a certain group of users full IAM privileges ...
- 1
0
votes
0
answers
94
views
Inverse of Third Party Authentication
Consider this scenario. I have a file hosted on AWS with private access. I want the file to be accessible to several authorized users of a web applicaton that I have built. As I am the one ...
- 101
0
votes
0
answers
229
views
Is it secure to rely on the data in a lambda context authorizer claims?
I am working on lambda authorization and I learned that there are generally two options.
Either use the default authorizer on the API gateway level, which will do all the heavy lifting (validate the ...
- 141
0
votes
0
answers
81
views
How can I give a network load balancer (of any type) access to a port on a machine without opening that port to an entire VPC?
Is it possible to make an AWS load balancer for a non-HTTP port allowed to access a specific port on a host without opening that port open to the entire VPC's subnet? I seem to remember reading that ...
- 139
0
votes
0
answers
64
views
Is Bucket Upload Policy a good pratice for upload files to AWS S3?
In AWS docs page has the following instructions to upload files to an AWS bucket from browser: https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html
This solution send to browser a ...
- 69
0
votes
1
answer
393
views
Are AWS security groups enough to segment network and reduce PCI scope?
I was reading this paper
https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf
It shows this image
Am I correct in saying that - as long as instances have proper security groups that ...
- 173
0
votes
0
answers
2k
views
Windows Firewall blocking local access to SQL Server?
I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
- 101
0
votes
0
answers
148
views
How to fix AWS security ALAS-2019-1149?
I need to investigate for the security hole ALAS-2019-1149(https://alas.aws.amazon.com/ALAS-2019-1149.html) which is report ed by AWS.
I saw in the session "Issue Correction"
Run yum update kernel to ...
- 113