Questions tagged [aws]
Amazon Web Services (AWS) are a set of cloud services offered by Amazon.
273
questions
4
votes
1
answer
2k
views
Is it insecure to expose private bucket names through signed URL?
AWS provides signed url to objects in bucket.On backend we can connect with AWS and create such signed urls and send to front-endJust discussing this one use case where we use that signed url to make ...
6
votes
3
answers
3k
views
Is it more secure to encrypt separate customers' data with separate keys?
If I am storing multiple customers' data in cloud-based file storage such as an AWS S3 bucket, and I use an encryption service such as AWS KMS to achieve encryption at rest, does it add any extra ...
- 193
2
votes
1
answer
317
views
Reason for lack of asymmetric cryptography in AWS KMS for regions in China
In the documentation of the AWS Key Management Service (KMS) I found this interesting sentence:
Asymmetric CMKs and asymmetric data key pairs are supported in all AWS Regions that AWS KMS supports ...
- 1,272
2
votes
2
answers
1k
views
SSH brute force entry in aws ec2 instance
I am planning to host a flask application on EC2 instance, which connects to a database. The database credentials are inside a folder on the server.
EC2 login can be done only via ssh private key. ...
0
votes
1
answer
808
views
DNS communicating with a remote host on an unusual server port 53
We have an Active Directory EC2 server on AWS US East region that has DNS enabled to resolve only internal hostnames. It is not reachable from any hosts on the public internet.
Recently we enabled an ...
- 103
0
votes
1
answer
245
views
AWS IAM policies that differentiate between console & access key access
Question:
How can an AWS IAM policy be devised to differentiate between a console (web) and access key (API) access?
Use Case:
Say, I want to allow the a certain group of users full IAM privileges ...
- 1
4
votes
1
answer
4k
views
Should JWT's be validated on every request?
I have been unable to find a definitive answer to the above question.
We currently use JWTs from AWS Cognito for our Authentication. Currently the JWTs that are returned are too large to use in ...
- 153
0
votes
0
answers
94
views
Inverse of Third Party Authentication
Consider this scenario. I have a file hosted on AWS with private access. I want the file to be accessible to several authorized users of a web applicaton that I have built. As I am the one ...
- 101
3
votes
1
answer
550
views
Can AWS Time Sync be argued PCI compliant?
We're setting up a card processing service on Amazon AWS, and were wondering whether the AWS Time Sync service could be incorporated without running afoul of the PCI time sync requirements?
...
- 131
5
votes
1
answer
3k
views
EKS managed worker nodes security patching
Do AWS EKS managed nodes receive security patching automatically or is it the owner's responsibility to patch?
- 53
0
votes
0
answers
229
views
Is it secure to rely on the data in a lambda context authorizer claims?
I am working on lambda authorization and I learned that there are generally two options.
Either use the default authorizer on the API gateway level, which will do all the heavy lifting (validate the ...
- 141
1
vote
0
answers
458
views
AWS Appsync authorization - why is IAM authorization safer than API Key based approach
We are currently evaluating which authorization type to use for our production AppSync APIs.
As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
- 111
3
votes
0
answers
180
views
concatenation vs multiple rounds of HMAC
I was studying the AWS request signature process and found that they derive the signing key from multiple sources (one and two related questions).
Specifically this:
kSecret = Your AWS Secret Access ...
- 131
1
vote
1
answer
181
views
Amazon S3 policies: CORS or Service Accounts?
I have a question about accessing buckets on AWS S3. Let's suppose we have a bucket that has to have public read access by everyone and only my API has to be able to PUT and DELETE items from bucket. ...
- 69
1
vote
3
answers
420
views
Why AWS distributes private key to address authentication problem?
AWS provides access to EC2 by downloading the private key(.pem) into management host that connects to EC2.
AWS uses openssl tool
Key providers generally provide public key but not private key, ...
- 113
3
votes
1
answer
1k
views
Are these log messages in my nginx server evidence of an attempted attack?
My AWS Elastic Beanstalk server is often reporting Environment health has transitioned from Ok to Severe. 100.0 % of the requests are erroring with HTTP 4xx. This happens almost daily for a few ...
- 577
4
votes
1
answer
366
views
PCI compliance with multiple AWS VPCs
If I have VPC which is in-scope (the "PCI VPC") and another which is not (the "NON-PCI VPC"), would peering them bring the non-pci vpc in-scope? Is there a way to avoid this?
I have an aurora RDS ...
1
vote
2
answers
936
views
Is there any Security issue if we not used SSL between AWS Cloudfront and AWS ALB?
I have an application that is hosted on AWS. It has an Application Load Balancer in its front and it is also attached to the Cloudfront to handle a heavy load. In my case, I have enabled SSL only on ...
- 111
1
vote
1
answer
115
views
AWS serverless site security. Anything else I should add? [closed]
I have an AWS static site in an S3 bucket, accessible through CloudFront and a bunch of lambda functions that form the backend of the site. Is there anything else I can/should do security wise to ...
- 115
0
votes
0
answers
81
views
How can I give a network load balancer (of any type) access to a port on a machine without opening that port to an entire VPC?
Is it possible to make an AWS load balancer for a non-HTTP port allowed to access a specific port on a host without opening that port open to the entire VPC's subnet? I seem to remember reading that ...
- 139
0
votes
0
answers
64
views
Is Bucket Upload Policy a good pratice for upload files to AWS S3?
In AWS docs page has the following instructions to upload files to an AWS bucket from browser: https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html
This solution send to browser a ...
- 69
1
vote
1
answer
830
views
Getting data from AWS Secrets Manager at deployment (ENV variables) vs. at run-time (e.g. aws-sdk)
Given a serverless deployment of some kind (i.e. something that relies on AWS Lambda for computing), and secrets stored in AWS Secrets Manager, what difference from security standpoint is there ...
- 143
1
vote
1
answer
841
views
How to harden against credential stealing in EC2 via the http://169.254.169.254 API?
AWS has a feature called Instance Metadata, which on EC2 gives you access to the AWS credentials through HTTP calls:
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>
...
- 1,064
4
votes
1
answer
376
views
Why isn't cloud (AWS, Azure, GCP) metadata served over HTTPS?
Why can any application or user on your server type an insecure URL like these to get server information about that instance?
http://instance-data.us-east-1.compute.internal/latest/meta-data/
http://...
- 1,035
0
votes
1
answer
436
views
TLS certificate - How to assign a CN name for an EC2?
AWS console(EC2 dashboard) shows public DNS name as ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com for an EC2 instance.
But the same AWS EC2 has a different DNS name (shown below):
$ hostname -...
- 113
1
vote
0
answers
96
views
'Hard-to-guess' custom header (or similar) to whitelist via a firewall
My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services.
We thought of doing ...
- 111
1
vote
2
answers
104
views
Serverless Apps Authenticate Users After Page Load - Flaw?
Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn't sent from the user's browser, the only content delivered to the user is a ...
23
votes
4
answers
7k
views
More than three domains hosted on the same IP address
Not on purpose I did a reverse IP address look up on my site, and it shows that there are three other websites hosted on my server, and now I'm worried.
My web is arturofm.com, and here is the lookup:...
- 363
1
vote
0
answers
63
views
Recomendation for automated rotation of a JSON keyring? [closed]
I have a Sailsjs app that is configured to encrypt model attributes with sensitive information. This seems to use bcrypt, under the hood and leverages a JSON keyring in the configuration (...
- 111
1
vote
1
answer
292
views
Is encryption/decryption done in the cloud when using CMK keys?
I am trying to understand how AWS KMS works, and there is one thing I am still not completely sure of: when using CMKs, so no Data Keys, no envelop encryption, does the encryption take place in the ...
- 111
2
votes
2
answers
426
views
Secure AWS instance metadata against potential SSRF
I am running a Windows instance on AWS.
The instance has an IIS service running on it.
The IIS service has a user associated to it and it has no need to access the AWS instance metadata.
I was ...
- 1,012
8
votes
2
answers
310
views
Is open-source infrastructure safe?
My AWS infrastructure is publicly available here.
Is this a security concern?
I was prompted to ask this following the Capital One breach and after learning about https://opensourceinfra.org/
Please ...
- 181
1
vote
0
answers
338
views
Is the example Amazon SNS Topic Policy for CloudTrail too permissive?
I'm trying to configure several AWS accounts to log CloudTrail to a central logging account, from which the logs will be brought into Splunk. In order to do this, I need to configure CloudTrail on ...
- 439
5
votes
3
answers
300
views
How can one centrally manage / audit AWS resource-based policies
An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
- 151
4
votes
2
answers
2k
views
S3 Bucket Name Obscurity as Security
Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. *
Can I assume that a public S3 ...
2
votes
2
answers
889
views
Securely provide AWS user with keys?
When creating a new user in AWS IAM, an admin sets the user's name and permissions for that user. The user's password and programmatic access keys (if programmatic access is granted) are then ...
1
vote
1
answer
836
views
Managing DUKPT keys in AWS cloud
I work on a payments system. So DUKPT keys are a must-have requirement. In most cases PIN and Card data are encrypted using DUKPT keys. However, every time we have checked with AWS, we have found ...
- 11
2
votes
1
answer
8k
views
In AWS EKS, how should Kubernetes certificates be generated?
This article from 2018 states (emphasis mine):
It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
- 494
0
votes
2
answers
650
views
Can I rely on Operating System (OS) Anti Virus (AV) scanning to scan files shares?
I have an EC2 instance with an Windows OS with anti virus installed.
I have a requirement to attach a file share to the OS where the application is hosted. The file share is Amazon Fsx ( Amazon's ...
- 651
0
votes
1
answer
396
views
Are AWS security groups enough to segment network and reduce PCI scope?
I was reading this paper
https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf
It shows this image
Am I correct in saying that - as long as instances have proper security groups that ...
- 173
1
vote
0
answers
244
views
Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS
I'm a bit new to coding backend services. And I'm not sure how to solve this problem.
So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
- 11
3
votes
3
answers
571
views
AWS S3 resource access control through IAM permissions or bucket policies?
The way we create buckets in our org and ensure sane ACLs around it is by providing an automated tool (that internally uses Terraform) to provision an S3 bucket. So say when a user requests for a new ...
- 1,522
0
votes
1
answer
656
views
Is detecting if an email has an account considered a vulnerability with AWS cognito?
Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS.
during the forget password flow, I noticed that Cognito request ...
- 149
1
vote
1
answer
152
views
Amazon Web Services ELB has permission to change DNS records by default?
I'm creating an ECS (Elastic Container Service) service on AWS. For that service, I need to supply an application load balancer. The default role for it is the following: AWSServiceRoleForECS. When I ...
- 245
1
vote
0
answers
148
views
What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?
I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
- 256
3
votes
1
answer
349
views
Is it Possible to Prevent a Physcial Attack on Server in Remote Data Center?
I've been using Amazon Web Services to run my Java application. However, due to high costs I'm looking into getting a dedicated server from Hetzner, a company based in Germany, which costs about 10-...
- 131
0
votes
1
answer
362
views
is there any need to encrypt sensitive images in a database?
I have a project that requires users to submit a photo of a driver's license as proof of identity. This image just needs to be seen once by an administrator, and has no use after their id is verified. ...
- 103
0
votes
1
answer
386
views
How to disclose an open S3 bucket?
What is the most responsible way of disclosing an open AWS S3 bucket?
Let's say there are sensitive documents inside, such as contracts with the company logo, that lead you to believe that it ...
0
votes
1
answer
568
views
Is it possible to securely run user defined python code in AWS?
I would like to create an app that accepts users python scripts and executes them as part of its functionality. What I am wondering is if its possible to block I/O, network and other attack vectors so ...
- 115
1
vote
0
answers
147
views
Is there a way to get a forensic image of EC2 instance [closed]
I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
- 63