Questions tagged [aws]
Amazon Web Services (AWS) are a set of cloud services offered by Amazon.
274
questions
1
vote
2
answers
2k
views
Amazon AWS S3 Unrestricted File Upload
While I was pentesting a web application, I found out that files that are uploaded to the web application are stored in an AWS S3 instance. Based on my experience, when a web application needs to ...
- 143
0
votes
1
answer
836
views
How do I get a forensic copy of an EC2 server?
Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
34
votes
4
answers
12k
views
Is serverless code immune to DDoS attacks?
In classic hosting we have a virtual machine with limited resources allocated by hosting provider for running our web application. But with serverless code such as AWS Lambda or Azure Functions, our ...
- 684
0
votes
0
answers
180
views
A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority
I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS.
My public web domain is ...
4
votes
4
answers
934
views
Is it good practice to disable firewall rules for vulnerability scanners?
I've been asked to ensure that our vulnerability scanning tools (like Qualys, Nexpose) are able to reach all of our AWS EC2 instances, on all ports and protocols.
Today they are limited by the current ...
1
vote
1
answer
264
views
AWS Private CM and FedRamp compliance for TLS
Is the use of a private, auto-signed certificate, created and managed by AWS Private CM, and use in internal TLS communication, for endpoints that do not require external verification, and do not have ...
- 111
0
votes
0
answers
729
views
OpenVPN client suddenly refuses to connect to my self-hosted VPN
It's been working fine for years, but now suddenly I'm getting a strange error. Does anyone know what problem this points to?
OpenVPN Connect Version 3.0.2 (598), error logs:
[REDACTED IPs]
5/16/2021,...
- 121
1
vote
1
answer
477
views
Can a Man-in-the-Middle-Attack be achieved by adding a cloudfront distribution origin of a domain not owned by me?
Cloudfront supports adding external origins, i.e. domains that are not S3 buckets or ALBs. This led me to wonder whether adding domains that are not owned by the entity as an origin could allow for ...
- 13
3
votes
1
answer
446
views
AWS credentials seem terribly insecure. Why? [closed]
In my ~/.aws/credentials I have the following:
[default]
aws_access_key_id = <something>
aws_secret_access_key = <something-else>
This file has permissions 0600 but doesn't ...
- 345
1
vote
1
answer
383
views
Does AWS store users' passwords without hashing?
I just noticed that AWS provides a service that checks your users' passwords for corporate password rule compliance "periodically": https://docs.aws.amazon.com/config/latest/developerguide/...
- 440
1
vote
0
answers
76
views
How to provide | revoke access to an AWS machine without going through the AWS console
Assuming if you do via SSH (which is shared among multiple team members), how to manage this from a security perspective or should each user be given a separate SSH key
- 111
1
vote
1
answer
213
views
Does adding a randomized string in S3 file path has equal security to Google Drive shared link
I would like to use an AWS S3 bucket to store my IoT firmware file and allows all of my IoT devices to access it to update the firmware to the latest version.
I want that the firmware file in the S3 ...
- 385
1
vote
3
answers
2k
views
Does domain resolve to CDN (Cloudfront) IP and not the actual web-app server?
If a web-app is using cloudfront as CDN, what happens if I ping the domain? Am I pinging the cloudfront endpoint? Or the web-app server? Why is it DNS resolution resolves to different IPs in this case?...
- 21
1
vote
1
answer
360
views
Thunderbird uses AWS: Secure?
In their Privacy Note, Mozilla writes the following:
Amazon Web Services: Thunderbird uses Amazon Web Services (AWS) to host its servers and as a content delivery network. Your device’s IP address is ...
- 113
1
vote
0
answers
79
views
Is there record of a pubilc RDS instance with strong password having been hacked?
I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet
However, the instance has a relatively strong ...
- 153
1
vote
2
answers
226
views
Hacking attemps from unkown source
I'm running a docker container in Kubernetes cluster running in aws, I exposed the container through LoadBalancer service and limited access to it just to my ip address using aws security groups, but ...
- 153
0
votes
2
answers
239
views
Separate SSL certs on CloudFront and Heroku?
I find SSL real confusing, but anyways.
For my frontend static website, I host on S3 and distribute using CF. I just use something simple like comodo SSL to generate an SSL cert and then go through ...
2
votes
3
answers
156
views
Is using a dedicated IP for AWS dev access secure enough?
I'm about to launch my first ever SaaS product on AWS and am thinking through security.
I have my main server, which is obviously public on :80 and :443, and then I have a bunch of other infra that I ...
- 123
1
vote
1
answer
229
views
Are AWS EC2 key-pairs compromised when an EC2 instance is compromised?
Suppose I have multiple EC2 instances deployed with the same key-pair. The key-pair is used for SSH access and general troubleshooting. If one instance is compromised, do I need to be concerned about ...
- 158
0
votes
1
answer
804
views
Isolation AWS resources with multiple subnets vs multiple VPCs
I have AWS resources (e.g. EC2s, RDS instances) that I would like to isolate from each other so that if one is compromised, the potential damage is limited. I am most concerned about data leakage / ...
- 158
0
votes
1
answer
3k
views
It's secure to store private keys in AWS Secret Manager?
I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
0
votes
1
answer
149
views
Limiting VPC subnet access for NAT OpenVPN clients
I'm currently testing OpenVPN to give developers limited access to AWS VPC's.
Assuming I have 3 VPC's... VPC-A, VPC-B, VPC-C, each of these with private and public subnets.
The OpenVPN server will be ...
- 935
0
votes
0
answers
114
views
How does AWS verify signed requests?
How does AWS request signing and verification work? Let's say I have created a signed request using this guide.
How does AWS service verify this signature? I see 2 options with their respective flaws (...
- 101
0
votes
0
answers
107
views
KMS Key Exposure
I've found some KMS key exposed in some code and am wondering what exactly the severity would be.
What could an attacker achieve by having this key?
- 189
1
vote
1
answer
248
views
Does this official "Enforce MFA" AWS policy make any sense?
At https://aws.amazon.com/premiumsupport/knowledge-center/mfa-iam-user-aws-cli/ the AWS officially recommends to have this policy
{
"Sid": "...
- 173
1
vote
1
answer
1k
views
Model for multi-tenant data encryption where the application owners or cloud providers cannot see decrypted data
Consider an application in which users will install on-premise agents which communicate with a cloud hosted service (aws in this case). The users can interact with the cloud service to configure and ...
- 153
1
vote
1
answer
234
views
How secure is setting mongodb to 0.0.0.0 but blocking all incoming requests to 27017 on ec2?
As the title suggests. If I set the net.bindIp setting in mongod.conf to 0.0.0.0 on port 27017 this should open it up to all incoming connections. However, if in my ec2 instance I whitelist only my ...
- 143
2
votes
1
answer
125
views
How to handle AWS credentials
Our web application features a lot of media upload. We are making use of AWS S3 buckets for media storage. As per the current implementation, whenever a new file upload API is called, we send the AWS ...
- 1,452
1
vote
1
answer
217
views
Letting users to download data from my Django app
I want to provide a way for my users to download their data, which are stored in S3, through my app. Should I provide them with a public url followed by a key random key, as in this example?
http://s3....
- 11
23
votes
2
answers
4k
views
How critical is encryption-at-rest for public cloud hosted systems?
I work as a solutions architect for web-based systems on AWS. As part of this role, I often respond to Information Security questionnaires. Nearly all questionnaires request information about data ...
- 355
2
votes
3
answers
1k
views
Making S3 objects viewable only for logged in users
As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve ...
- 21
-1
votes
1
answer
375
views
OWASP ZAP: How to Test on AWS + Magento? Which guidelines must be observed? [closed]
I am supposed to do a test for AWS. But since AWS has limitations, probably also in the direction of DDoS and other points, what does a corresponding test scenario look like?
It is about a Magento ...
- 131
3
votes
1
answer
2k
views
Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?
I have developed my DRF back-end API locally, deployed it on an AWS Lightsail instance (with a public static IP) and I now want to secure it with HTTPS.
I understand that in order to use Let's Encrypt ...
- 187
3
votes
3
answers
759
views
What are the security dangers of using Security Groups instead of NAT Gateways for isolating AWS RDS databases from public access?
As I have learned, there are two main ways of isolating resources in AWS VPC
One through public/private subnet separation using NAT Gateways to route communications between resources (e.g. public web ...
- 153
3
votes
1
answer
335
views
PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda
Our architecture is based on the best practices for PCI-DSS on AWS
Amazon WAF -> API Gateway -> AWS Lambda
The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
- 153
0
votes
2
answers
130
views
Is there a bulletproof way to configure your AWS system? [closed]
I am learning how to configure a multi-region AWS system. However, everything I read says "if you want/need more security then do X". Why would anyone want less security (is what I start ...
- 608
2
votes
1
answer
228
views
Should you let yourself ssh into every machine in your network?
I am wondering how you should setup your network (AWS) so you can debug different things that might occur. Obviously there's logging, but it seems at some point you might require SSHing into the ...
- 608
0
votes
2
answers
753
views
How do you get a secure bastion host if your IP address is constantly changing?
I am setting up AWS stuff and wondering how to setup a secure bastion host. They all say to only allow access to your IP address, but how can I do that if my IP address is changing every few hours or ...
- 608
12
votes
1
answer
3k
views
Hijacking stale DNS entry to point to your own website
Context and system configuration:
AWS EC2 instance with a public IP address
AWS Route53-managed DNS with a somesubdomain.somedomain.io pointing to the above IP address
Above AWS EC2 instance was not ...
- 682
2
votes
1
answer
1k
views
Why is ID token used instead of Access token to get temporary credentials in AWS?
After a user logons to cognito, he receives access and ID tokens. the ID token contains sensitive info like phone number, email, etc..
From all standards - ID token should not be used to gain access ...
- 189
1
vote
4
answers
4k
views
AWS - YubiKey lost... now what?
I just received my YubiKey and was playing with it. It works brilliantly but I couldn't help thinking what would happen if I would lose the key. Well, for Google you can print out some backup codes, ...
- 111
27
votes
12
answers
7k
views
Is starting an AWS instance with only ssh to port 22 significantly insecure?
Unless someone has my private ssh key, how is leaving an aws instance open to 0.0.0.0 but only on port 22 via ssh insecure?
The ssh key would be distributed to a small set of people. I prefer to not ...
1
vote
2
answers
1k
views
Encrypt backup files and send them to AWS S3
I have a backup routine via crontab on Ubuntu.
This routine generates a compressed tar.gz file and sends it to AWS S3.
But I want to encrypt these files and be able to decrypt them when necessary on ...
- 174
4
votes
1
answer
870
views
Security implications of using public subnets in AWS VPC for hosting web and job servers
I have been using AWS for hosting personal projects, mostly in the form of containerized Django web apps running on ECS with Fargate. I have referenced this article to better understand Fargate task ...
- 223
2
votes
2
answers
3k
views
Why is my computer connected to amazon instances
When I run the command netstat -a to see the actual connections on my computer, I see all the time that my computer is connected to something like this ec2-xx-xx-xx-xx, not just one address it changes ...
- 123
1
vote
2
answers
309
views
Solutions for backing-up my codebase
I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github ...
- 31
1
vote
3
answers
461
views
Security considerations when naming S3 Buckets
What security considerations should be taken into account when naming an S3 bucket?
0
votes
0
answers
85
views
Naming AWS resources
For S3 bucket names, anyone can query a bucket name (without specifying an account owner) and see if the bucket is misconfigured to allow public access.
Therefore, it arguably makes sense to use a ...
0
votes
0
answers
142
views
WAF really Needed?
I'm running a company web application in AWS. This web app is behind a cognito+External Identity provider with SAML for only allowing company employees to reach the app (then they log in with local ...
2
votes
1
answer
277
views
Does AWS KMS use HSM underneath by default?
Have a doubt about about how AWS KMS handles their asymmetrical/symmetrical keys. Does AWS KMS use Hardware Security Modules (HSMs) underneath by default? (cant find documentation that prove/dissmiss ...
- 21