Questions tagged [aws]
Amazon Web Services (AWS) are a set of cloud services offered by Amazon.
273
questions
5
votes
2
answers
3k
views
Differences between the Root user and users with AdministratorAccess in AWS
I am trying to determine the differences (if any) between using the AWS Root user, or a user within the AdministratorAccess group in AWS. The AdministratorAccess is given the following privileges:
{
...
- 53
1
vote
1
answer
121
views
How we can PoC our product that needs training data for our machine learning algorithm of the the bank clients?
Recently, we have had a challenge with potential future clients which are the bank. Our product requires to gather static data (e.g. address, loans, last 50 transactions, etc) of banks clients. These ...
- 1,264
0
votes
0
answers
2k
views
Windows Firewall blocking local access to SQL Server?
I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
- 101
3
votes
1
answer
2k
views
Security Audit on AWS - question on findings
Just wondering about an assessment I'm doing regarding a client's AWS environment.
I'm new to AWS to I'm having to learn a lot on the go.
I used ScoutSuite and got some findings, specifically:
EC2:
*...
- 43
2
votes
2
answers
3k
views
How can I encrypt messages sent over AWS PrivateLink?
I am working on a project where I need to send messages to a partner via AWS PrivateLink. Because these messages contain PII, the data needs to be secure. I have been unable to determine from internet ...
- 123
1
vote
0
answers
32
views
Nmap showing different open ports every few seconds [duplicate]
I'm running Nmap on an Amazon Web Services EC2 instance but between runs just a couple seconds apart, I'm getting new results. Is this normal? I'm seeing open ports then they don't show.
I'm running ...
- 11
0
votes
2
answers
975
views
Windows Server: Import HSM-backed certificate into second server
Scenario:
Using Amazon CloudHSM with CloudHSM Windows Client installed and configured.
Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider.
Submitted ...
- 101
0
votes
1
answer
129
views
Explanation of the authentication procedure when using signed certificates [duplicate]
I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT.
On my device side, I have a device certificate ( deviceCert.crt ) and the device ...
- 267
0
votes
0
answers
148
views
How to fix AWS security ALAS-2019-1149?
I need to investigate for the security hole ALAS-2019-1149(https://alas.aws.amazon.com/ALAS-2019-1149.html) which is report ed by AWS.
I saw in the session "Issue Correction"
Run yum update kernel to ...
- 113
1
vote
1
answer
219
views
Should I take (Pen test) approval from AWS for Fuzz testing my Application API's hosted on AWS? [closed]
I wanted to Fuzz Tests my API's on my own stack which are hosted on AWS environment (Have used lambdas and API gateway)
There are mostly GET APIs and only one PUT API.My requirement is to Fuzz Test ...
- 11
4
votes
1
answer
146
views
Is there any harm to writing a short plain-text string to authorized_keys?
I have a CFN template where I'm seeding an authorized key for testing via paramaters, through a build server. If this value is not provided by the build job, it defaults to a short, plain text string, ...
- 143
1
vote
1
answer
282
views
Is my server under some kind of reconnaisance/attack?
Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server.
I don't have those ...
- 111
2
votes
0
answers
1k
views
Using Google Authentication with Lambda@Edge and S3 Static Sites
I am looking to set up authentication on an S3 hosted static site. The configuration is:
S3 bucket configured to allow access via cloudfront
AWS Cloudfront distribution with HTTPS configured and a ...
- 166
1
vote
2
answers
546
views
Penetration Testing authorization from AWS
We have a few web applications newly hosted on AWS. Before we run an automated pentest on the our Application URL using Netsparker, we had always e-mailed Amazon and requested authorization for the ...
- 1,307
1
vote
2
answers
736
views
Is AWS subnets enough for segregation of networks? or do we need VPC?
Is AWS subnets enough for segregation of networks with the all security groups? or do we need VPC to really issolate two application from each other?
- 53
2
votes
1
answer
116
views
What is the impact of leaving disabled root key on AWS instance?
I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance.
When asked to remove the root key, he said it's disabled now so what's the ...
- 183
2
votes
1
answer
254
views
What attack vectors does AWS SSE-S3 help mitigate?
Reading into the various SSE options on S3, I'm can't understand the following:
What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against?
I can only think of ...
- 143
3
votes
0
answers
125
views
AWS SSM Agent protection
Our company is moving to the AWS cloud recently, and AWS relies a lot on the SSM agent, it is also opensource. ( https://github.com/aws/amazon-ssm-agent )
From my understanding, this agent is not ...
user50312
2
votes
2
answers
1k
views
AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation
I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture.
We are using components such as AWS Lambda, AWS ...
- 1,119
1
vote
1
answer
530
views
How secure is SSL private key in AWS ELB service?
We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
- 2,023
0
votes
1
answer
499
views
Best practice for config files for ec2 instances
I am building a lamp server ec2 image for a project we are doing. These images will be in an autoscaling group and on startup will be running startup script.
THere are some config files that have ...
- 103
1
vote
1
answer
795
views
How secure is it to use port forwarding for VNC?
I am following this tutorial that explains how to use a VNC client to logon to an Amazon EC2 instance. After a few steps, it asks me to login to the instance using port forwarding using this command:
...
- 13
1
vote
0
answers
113
views
What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?
When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2.
I have gone ...
- 23
1
vote
1
answer
470
views
Getting scanned on AWS Elastic BeanStalk
As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
1
vote
0
answers
86
views
Are there any additional security precautions I can or should take with my service?
Suppose I'm building a service to store all the secure or sensitive information that my other applications use. Think passwords, or private SSH keys. Under the old programming paradigm of 'do one ...
- 111
1
vote
2
answers
408
views
unable to verify AWS EC2 Instance Identity Document with libressl
I'm trying to follow the steps here:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html
to verify an instance identity document, and I'm getting success when I ...
- 165
4
votes
1
answer
642
views
envelope encryption (using KMS) vs ECDH
at work I have implemented basic envelope encryption when sending messages to a client.
I am using AWS KMS and have a master key there.
I get a data key, encrypt the message with AES-GCM and send the ...
- 141
0
votes
1
answer
2k
views
AWS Load Balancer Response Header Apache Server Disclosure
I have a node.js environment deployed using AWS Elastic Beanstalk on an Apache server. I have run a PCI scan on the environment and I'm getting 2 failures:
Apache ServerTokens Information Disclosure
...
- 313
1
vote
1
answer
2k
views
Is this the correct way to use AWS Cognito?
I am doing the following in my React/Node App:
Using the User Pools for a Cognito App that I have created
Calling the /login endpoint with response_type=token in my React App
Once I receive the JWT ...
- 113
0
votes
0
answers
193
views
Meltdown checker says AWS and Rackspace is vulnerable - Why?
Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with
7 of 8 variants OK (the failed one is apparently ...
- 1,162
1
vote
1
answer
94
views
What is needed to secure a docker container that's running on nodes in an AWS Private Subnet with internet access only via NAT?
I know securing a container is a big deal and a lot is needed to be done to secure a default container configuration. But having it in a private subnet should take care of a lots of risks.
So what ...
- 13
3
votes
1
answer
433
views
AWS Flowlog for Private Subnet Showing Routable IP's
When reviewing Flowlogs for a host on a private subnet in an AWS VPC that routable IP addresses are being rejected. How is that possible? I expect IP addresses from the private subnet could be ...
- 1,820
0
votes
1
answer
135
views
How to fix AWS security hole ALAS-2018-1045?
I am researching about the security hole CVE-2018-12020 and learned that you need to update to min version 2.2.8 to fix the issue.
I need to fix this for my EC2. I read information from this offical ...
- 113
2
votes
2
answers
862
views
How can AWS API Gateway be used to rapidly rotate credentials in this fashion?
Reading through this article, I hit a little wall of understanding. The author states:
This is because my laptop doesn’t have the secret weapon. Once you get
this up and running on an EC2 ...
- 1,149
2
votes
1
answer
883
views
Amazon EC2 Abuse Report
My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance.
The email states:
We observed machines under your control ...
- 23
2
votes
2
answers
786
views
How are stateless firewalls useful in public cloud platforms?
I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
- 857
1
vote
1
answer
318
views
Is AWS Elastic Beanstalk traffic from load balancer to backend EC2 instances secure?
AWS Elastic Beanstalk service routes traffic back to its EC2 instances through HTTP by default. I know this can be configured to achieve end to end encryption by adding SSL encryption from the load ...
- 113
3
votes
2
answers
748
views
Should I have an SSH bastion?
I am using AWS. I need to connect with a local SSH client to Linux EC2/ECS instances. I also need to connect with a local PostgreSQL client to RDS instances.
There are tutorials for creating SSH ...
- 1,010
2
votes
1
answer
443
views
Are Self-Encrypting Drives (SEDs) used in cloud environments?
I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS?
And if so, what additional protection do they offer beside from physical theft of the ...
- 21
0
votes
1
answer
113
views
How does Amazon Web Services generate SSH Keys?
How does Amazon Web Services generate SSH Keys? Does it generate the key pair completely in the browser or does it generate the keys in the server and send us the private key over HTTPS?
I tried to ...
- 857
20
votes
2
answers
10k
views
Keeping AWS account ID secret
Must my AWS account ID be kept secret? Can anything at all be done using just the AWS account ID?
From the AWS documentation:
The AWS account ID is a 12-digit number, such as 123456789012, that ...
1
vote
1
answer
166
views
How is AWS app identity verified?
So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
5
votes
5
answers
2k
views
Cloud provider for Penetration Testing
I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests.
The issue I am having is finding a cloud provider such as AWS, Azure etc. for this.
For AWS they ...
- 81
0
votes
1
answer
609
views
Reasons to transition Kerberos secured web applications to OAuth2/OpenId
We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) .
...
- 103
3
votes
1
answer
158
views
Securely retrieving and exposing configuration within Docker
It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
- 133
1
vote
1
answer
795
views
What are the risks of placing Amazon Resource Names (ARNs) in VCS repositories?
Amazon Resource Names (ARNs) uniquely identify AWS resources. Amazon requires an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational ...
- 111
6
votes
2
answers
279
views
Do Transient, Volatile Servers Require Antivirus Scanners?
We are often asked whether we install antivirus software on our servers, specifically the kind of signature-based scanners that run on a schedule. Client security questionnaires and ISMSes often ...
- 463
3
votes
1
answer
6k
views
Amazon AWS KMS - Concept of signing in general and with JWT
Looking into Amazon AWS KMS (Key Management System).
Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/...
- 977
5
votes
1
answer
785
views
Dual - control (two man access) to AWS root logins?
I've been going around a few threads / questions here but none of them actually talked about concrete implementation of two-man authorization methods. I've read reasonable amount of ideas and "why"s ...
- 51
31
votes
3
answers
16k
views
Is an AWS "Access Key ID" a secret?
AWS's "Secret Key" is (obviously) a secret, but should an "Access Key" alone (without the corresponding secret key) be considered a secret too?
- 737