Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

Filter by
Sorted by
Tagged with
34 votes
4 answers
12k views

Is serverless code immune to DDoS attacks?

In classic hosting we have a virtual machine with limited resources allocated by hosting provider for running our web application. But with serverless code such as AWS Lambda or Azure Functions, our ...
Mr. Engineer's user avatar
31 votes
3 answers
16k views

Is an AWS "Access Key ID" a secret?

AWS's "Secret Key" is (obviously) a secret, but should an "Access Key" alone (without the corresponding secret key) be considered a secret too?
Daniel Serodio's user avatar
28 votes
3 answers
5k views

Pentesting against own web service hosted on 3rd party platform

I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
knipp's user avatar
  • 589
27 votes
12 answers
7k views

Is starting an AWS instance with only ssh to port 22 significantly insecure?

Unless someone has my private ssh key, how is leaving an aws instance open to 0.0.0.0 but only on port 22 via ssh insecure? The ssh key would be distributed to a small set of people. I prefer to not ...
WestCoastProjects's user avatar
23 votes
4 answers
7k views

More than three domains hosted on the same IP address

Not on purpose I did a reverse IP address look up on my site, and it shows that there are three other websites hosted on my server, and now I'm worried. My web is arturofm.com, and here is the lookup:...
Arturo's user avatar
  • 363
23 votes
2 answers
4k views

How critical is encryption-at-rest for public cloud hosted systems?

I work as a solutions architect for web-based systems on AWS. As part of this role, I often respond to Information Security questionnaires. Nearly all questionnaires request information about data ...
jdog's user avatar
  • 355
22 votes
2 answers
5k views

How to use AWS KMS securely?

I am investigating using AWS KMS (Amazon Web Services Key Management Service) to decrypt an encrypted symmetric key (i.e: envelope encryption). However, to use the KMS, I need to pass it my amazon ...
Vanita's user avatar
  • 415
20 votes
2 answers
10k views

Keeping AWS account ID secret

Must my AWS account ID be kept secret? Can anything at all be done using just the AWS account ID? From the AWS documentation: The AWS account ID is a 12-digit number, such as 123456789012, that ...
octothorpe_not_hashtag's user avatar
18 votes
2 answers
4k views

What is the threat model for AWS EBS volumes encryption?

AWS provides the ability to encrypt EBS volumes, the value of which I am wondering about. In the "Overview of Security Processes (October 2016)" whitepaper, page 24, they say: Encryption of ...
Greendrake's user avatar
13 votes
2 answers
16k views

Best practices for managing AWS EC2 Key Pairs

Our organization uses Amazon Web Services (AWS), and we have multiple EC2 instances running in different subnets (VPCs) for different clients. Our application is in development and we have need to ...
Lemonseed's user avatar
  • 263
12 votes
1 answer
3k views

Hijacking stale DNS entry to point to your own website

Context and system configuration: AWS EC2 instance with a public IP address AWS Route53-managed DNS with a somesubdomain.somedomain.io pointing to the above IP address Above AWS EC2 instance was not ...
automatictester's user avatar
12 votes
2 answers
2k views

AWS Security - Dev Test Staging Production Environments

Right now all our systems are in a traditional data center and traditional network topology. We're planning to migrate to AWS and in doing so we're trying to figure out how to implement our dev/test/...
Brad's user avatar
  • 613
12 votes
1 answer
2k views

Does the TLS 1.0 support on CloudFront create a vulnerability when only TLS 1.2 is enabled on the Origin side?

We currently host our website on AWS with CloudFront. CloudFront currently does not support disabling TLS 1.0 or 1.1 on the Viewer side. It only provides support for limiting access to TLS 1.2 on the ...
Charles Green's user avatar
10 votes
2 answers
6k views

Is there any risk to enabling CORS with a wildcard on S3?

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
user2719333's user avatar
9 votes
1 answer
580 views

What does Spectre mean for public cloud computing?

From a tweetstorm by security journalist Nicole Perlroth: The most visceral attack scenario is an attacker who rents 5 minutes of time from an Amazon/Google/Microsoft cloud server and steals data ...
Anders's user avatar
  • 65.4k
8 votes
2 answers
310 views

Is open-source infrastructure safe?

My AWS infrastructure is publicly available here. Is this a security concern? I was prompted to ask this following the Capital One breach and after learning about https://opensourceinfra.org/ Please ...
Shadi's user avatar
  • 181
7 votes
3 answers
31k views

How can I kill minerd malware on an AWS EC2 instance? [duplicate]

I have an AWS EC2 instance running RHEL 7.2 which seems to have been hacked by a BitCoin CPU Miner. When I run ps -eo pcpu,args --sort=-%cpu | head, it shows that there is a CPU miner that's taking up ...
Anish Sana's user avatar
7 votes
2 answers
5k views

How to securely store secrets in Docker container?

The application I'm working on has more than a dozen of secrets, SSL certificates and API keys. Currently I have a file that's added into .gitignore and it contains all my secrets. How to securely ...
roman's user avatar
  • 323
6 votes
2 answers
279 views

Do Transient, Volatile Servers Require Antivirus Scanners?

We are often asked whether we install antivirus software on our servers, specifically the kind of signature-based scanners that run on a schedule. Client security questionnaires and ISMSes often ...
Louis Jackman's user avatar
6 votes
3 answers
3k views

Is it more secure to encrypt separate customers' data with separate keys?

If I am storing multiple customers' data in cloud-based file storage such as an AWS S3 bucket, and I use an encryption service such as AWS KMS to achieve encryption at rest, does it add any extra ...
CFL_Jeff's user avatar
  • 193
6 votes
1 answer
4k views

Security of setting access to S3 bucket only from a particular website

I read about setting access to S3 bucket only from a particular website in Amazon Docs. And I quote : Suppose you have a website with domain name (www.example.com or example.com) with links to ...
Amit Tomar's user avatar
6 votes
1 answer
6k views

Why can't I delete the default AWS security group?

There are no inbound nor outbound rules. It's an empty group. What use does it serve?
Chloe's user avatar
  • 1,758
6 votes
3 answers
1k views

Is it OK to pass credentials to the client to allow it to upload files to Amazon S3?

Our mobile app will be uploading images to AWS S3. The question is whether to do one of the following options: Upload the image to our APIs server, then our APIs server uploads the image to S3 Pros: ...
Samir Sabri's user avatar
5 votes
1 answer
3k views

Understanding ssh-rsa not in PubkeyAcceptedAlgorithms

I am having problem in connecting to an Amazon EC2 Linux instance from an old Mac OS machine running El Capitan. Unfortunately without any possibility to upgrade the OS. Because all the other modern ...
Leonardo's user avatar
  • 153
5 votes
2 answers
3k views

Differences between the Root user and users with AdministratorAccess in AWS

I am trying to determine the differences (if any) between using the AWS Root user, or a user within the AdministratorAccess group in AWS. The AdministratorAccess is given the following privileges: { ...
sommr's user avatar
  • 53
5 votes
2 answers
143 views

Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers

We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
Brogrammer's user avatar
5 votes
1 answer
3k views

How AWS access key id and secret access key are generated internally

According to AWS's documentation, for accessing AWS resources programmatically or via CLI, you can generate an access key in AWS console like: Access Key ID: AKIAIOSFODNN7EXAMPLE Secret Access Key: ...
nybon's user avatar
  • 151
5 votes
2 answers
7k views

Finding the company name by the AWS IP address [closed]

Is there any way to find out company/domain name of the company name by a given AWS IP address owned by them? nslookup and centralops.com will show only indicate the IP is on AWS.
Ashish Gupta's user avatar
5 votes
2 answers
1k views

Best Practice for MFA on Root AWS Accounts

I would like to enable multi-factor authentication on my organization's AWS root account, however I'm unsure of the best practices on how to do so. We already have separate IAM accounts for each ...
crgwbr's user avatar
  • 103
5 votes
1 answer
3k views

EKS managed worker nodes security patching

Do AWS EKS managed nodes receive security patching automatically or is it the owner's responsibility to patch?
vkoukou's user avatar
  • 53
5 votes
1 answer
783 views

Dual - control (two man access) to AWS root logins?

I've been going around a few threads / questions here but none of them actually talked about concrete implementation of two-man authorization methods. I've read reasonable amount of ideas and "why"s ...
Nishant's user avatar
  • 51
5 votes
5 answers
2k views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
K92's user avatar
  • 81
5 votes
1 answer
853 views

AWS Tenant Restrictions

I'm a sysadmin of a medium sized chain of Italian restaurants. While I'm not dealing with patient health records or financial information I am still security focused. I'm trying to achieve tenant ...
oklSDfJDFLJSDfklj's user avatar
5 votes
1 answer
3k views

AWS-S3 Signed URL Security concern

When you create a pre-signed URL for your object, you must provide expiration date and time. The pre-signed URLs are valid only for the specified duration. Anyone who receives the pre-signed URL can ...
Aniketk's user avatar
  • 51
5 votes
0 answers
8k views

What does a POST like 0x%5B%5D=somename try to achieve?

We created a default environment on AWS Elastic Beanstalk using their Python "sample app". After some time, the logs show a large number of POST requests with bodies like this: b'0x%5B%5D=...
djvg's user avatar
  • 463
5 votes
3 answers
299 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
Master_Yoda's user avatar
4 votes
3 answers
3k views

AWS S3 and 2-factor (multifactor)

I have a client looking to use AWS S3 buckets for file transfer to other clients. That data may have some sort of protected data in it. I'd like to set up S3 to use 2-factor or MFA for the login/...
MikeP's user avatar
  • 1,209
4 votes
1 answer
2k views

Is it insecure to expose private bucket names through signed URL?

AWS provides signed url to objects in bucket.On backend we can connect with AWS and create such signed urls and send to front-endJust discussing this one use case where we use that signed url to make ...
Akshay Vijay Jain's user avatar
4 votes
2 answers
2k views

S3 Bucket Name Obscurity as Security

Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. * Can I assume that a public S3 ...
David_Springfield's user avatar
4 votes
1 answer
373 views

Why isn't cloud (AWS, Azure, GCP) metadata served over HTTPS?

Why can any application or user on your server type an insecure URL like these to get server information about that instance? http://instance-data.us-east-1.compute.internal/latest/meta-data/ http://...
LTPCGO's user avatar
  • 1,035
4 votes
1 answer
873 views

Security implications of using public subnets in AWS VPC for hosting web and job servers

I have been using AWS for hosting personal projects, mostly in the form of containerized Django web apps running on ECS with Fargate. I have referenced this article to better understand Fargate task ...
briancaffey's user avatar
4 votes
1 answer
4k views

Should JWT's be validated on every request?

I have been unable to find a definitive answer to the above question. We currently use JWTs from AWS Cognito for our Authentication. Currently the JWTs that are returned are too large to use in ...
StuartM's user avatar
  • 153
4 votes
1 answer
641 views

envelope encryption (using KMS) vs ECDH

at work I have implemented basic envelope encryption when sending messages to a client. I am using AWS KMS and have a master key there. I get a data key, encrypt the message with AES-GCM and send the ...
KOT's user avatar
  • 141
4 votes
1 answer
543 views

How secure is http communication between AWS ELB and EC2 Instances

We have a VPC with security group set between AWS ELB and EC2 instances. However, when a request is forwarded to EC2 instances, we forward it via http, not https. Http being not encrypted and given ...
Seong Kim's user avatar
4 votes
1 answer
363 views

PCI compliance with multiple AWS VPCs

If I have VPC which is in-scope (the "PCI VPC") and another which is not (the "NON-PCI VPC"), would peering them bring the non-pci vpc in-scope? Is there a way to avoid this? I have an aurora RDS ...
Ian Buffington's user avatar
4 votes
1 answer
146 views

Is there any harm to writing a short plain-text string to authorized_keys?

I have a CFN template where I'm seeding an authorized key for testing via paramaters, through a build server. If this value is not provided by the build job, it defaults to a short, plain text string, ...
Cognitiaclaeves's user avatar
4 votes
1 answer
17k views

Amazon Elastic Load Balancer and mutual authentication

Has anyone configured AWS ELB (Elastic Load Balancer) to do mutual authentication (i.e., authenticate both the server and client), probably over TLS. We're exposing a REST API using SSH and a shared ...
Toby Sarver's user avatar
4 votes
2 answers
275 views

Data breach policy - immediate actions

We have a web application server and a database on AWS. Is there any "immediate action" policy somewhere we can adopt as to the steps we can take when we suspect or detect a data breach?
JasonGenX's user avatar
  • 153
4 votes
4 answers
941 views

Is it good practice to disable firewall rules for vulnerability scanners?

I've been asked to ensure that our vulnerability scanning tools (like Qualys, Nexpose) are able to reach all of our AWS EC2 instances, on all ports and protocols. Today they are limited by the current ...
An Anonymous AWS User's user avatar
3 votes
1 answer
2k views

Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?

I have developed my DRF back-end API locally, deployed it on an AWS Lightsail instance (with a public static IP) and I now want to secure it with HTTPS. I understand that in order to use Let's Encrypt ...
kingJulian's user avatar

1
2 3 4 5 6