Questions tagged [aws]

Amazon Web Services (AWS) are a set of cloud services offered by Amazon.

Filter by
Sorted by
Tagged with
2 votes
1 answer

How to set up a pentesting lab in Amazon Web Services?

How can I add vulnerable VMs in AWS instance of Kali? Do I need to install VMware or Virtualbox on top of the Kali instance in the cloud and then install the vulnerable VMs or is there any other ...
cradlr's user avatar
  • 23
3 votes
2 answers

How secure is a user in MySQL?

Let's say I have two databases on the same server (e.g. AWS RDS), DB1 and DB2. There are two users with some restrictions, and each user is assigned to a different database. US1 have access to DB1, ...
Theodore's user avatar
  • 307
6 votes
1 answer

Why can't I delete the default AWS security group?

There are no inbound nor outbound rules. It's an empty group. What use does it serve?
Chloe's user avatar
  • 1,758
22 votes
2 answers

How to use AWS KMS securely?

I am investigating using AWS KMS (Amazon Web Services Key Management Service) to decrypt an encrypted symmetric key (i.e: envelope encryption). However, to use the KMS, I need to pass it my amazon ...
Vanita's user avatar
  • 415
28 votes
3 answers

Pentesting against own web service hosted on 3rd party platform

I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
knipp's user avatar
  • 589
5 votes
1 answer

How AWS access key id and secret access key are generated internally

According to AWS's documentation, for accessing AWS resources programmatically or via CLI, you can generate an access key in AWS console like: Access Key ID: AKIAIOSFODNN7EXAMPLE Secret Access Key: ...
nybon's user avatar
  • 151
4 votes
3 answers

AWS S3 and 2-factor (multifactor)

I have a client looking to use AWS S3 buckets for file transfer to other clients. That data may have some sort of protected data in it. I'd like to set up S3 to use 2-factor or MFA for the login/...
MikeP's user avatar
  • 1,209
1 vote
2 answers

AWS HIPAA requires hardware dedicated to a single customer

Amazon HIPAA compliance requires customers to run on dedicated hardware ( I would think isolation of the operating system and encryption of data ...
henry's user avatar
  • 13
2 votes
1 answer

How much security does double VPN layer adds?

For doing ssh into our AWS infrastructure outside of office, we are required to connect to a VPN which gives us an office IP. Once we are connected to this VPN we are required to connect to another ...
Jeff's user avatar
  • 21
4 votes
1 answer

How secure is http communication between AWS ELB and EC2 Instances

We have a VPC with security group set between AWS ELB and EC2 instances. However, when a request is forwarded to EC2 instances, we forward it via http, not https. Http being not encrypted and given ...
Seong Kim's user avatar
18 votes
2 answers

What is the threat model for AWS EBS volumes encryption?

AWS provides the ability to encrypt EBS volumes, the value of which I am wondering about. In the "Overview of Security Processes (October 2016)" whitepaper, page 24, they say: Encryption of ...
Greendrake's user avatar
0 votes
2 answers

Private AES-GCM key

I'm using Amazon's (AWS) Key Management Service (KMS) to encrypt user data, the KMS uses AES-GCM cryptography. My problem is that as the AES-GCM key is stored in the KMS and I, as an administrator ...
John Smith's user avatar
6 votes
1 answer

Security of setting access to S3 bucket only from a particular website

I read about setting access to S3 bucket only from a particular website in Amazon Docs. And I quote : Suppose you have a website with domain name ( or with links to ...
Amit Tomar's user avatar
4 votes
1 answer

Amazon Elastic Load Balancer and mutual authentication

Has anyone configured AWS ELB (Elastic Load Balancer) to do mutual authentication (i.e., authenticate both the server and client), probably over TLS. We're exposing a REST API using SSH and a shared ...
Toby Sarver's user avatar
1 vote
2 answers

AWS RDS MySQL database publically avalible

We currently have two EC2 instances and a RDS instance. Both a EC2 instance and the RDS instance a hosted on AWS in the same region. However, the second EC2 instance is on a different region. ...
freebie's user avatar
  • 111
5 votes
1 answer

AWS-S3 Signed URL Security concern

When you create a pre-signed URL for your object, you must provide expiration date and time. The pre-signed URLs are valid only for the specified duration. Anyone who receives the pre-signed URL can ...
Aniketk's user avatar
  • 51
1 vote
1 answer

Pentesting a Data Warehouse?

One client has recently implemented AWS and has a EC2 instance running. We have made one scoping call and further to that they provided me with a diagram that I have modified to avoid any issue: The ...
winsmak's user avatar
  • 59
13 votes
2 answers

Best practices for managing AWS EC2 Key Pairs

Our organization uses Amazon Web Services (AWS), and we have multiple EC2 instances running in different subnets (VPCs) for different clients. Our application is in development and we have need to ...
Lemonseed's user avatar
  • 263
7 votes
3 answers

How can I kill minerd malware on an AWS EC2 instance? [duplicate]

I have an AWS EC2 instance running RHEL 7.2 which seems to have been hacked by a BitCoin CPU Miner. When I run ps -eo pcpu,args --sort=-%cpu | head, it shows that there is a CPU miner that's taking up ...
Anish Sana's user avatar
2 votes
2 answers

Am I vulnerable while leaving a putty client connected to my Amazon Web Server?

I'm not worried or concerned, but I am curious as to what types of exploitation I might expose my home server to if I leave a putty client connected using SSH. I am using putty to connect to an EC2 ...
PositriesElectron's user avatar
1 vote
1 answer

AWS S3 Server-side Encryption - Client Provided Keys PHP

It is a bit strange to me this isn't a commonly discussed topic yet but I am working with an AWS S3 storage server trying to implement server-side encryption using the option of a client provided key (...
codin's user avatar
  • 61
4 votes
2 answers

Data breach policy - immediate actions

We have a web application server and a database on AWS. Is there any "immediate action" policy somewhere we can adopt as to the steps we can take when we suspect or detect a data breach?
JasonGenX's user avatar
  • 153
10 votes
2 answers

Is there any risk to enabling CORS with a wildcard on S3?

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
user2719333's user avatar

1 2 3 4 5