Questions tagged [aws]
Amazon Web Services (AWS) are a set of cloud services offered by Amazon.
273
questions
2
votes
1
answer
4k
views
How to set up a pentesting lab in Amazon Web Services?
How can I add vulnerable VMs in AWS instance of Kali? Do I need to install VMware or Virtualbox on top of the Kali instance in the cloud and then install the vulnerable VMs or is there any other ...
- 23
3
votes
2
answers
220
views
How secure is a user in MySQL?
Let's say I have two databases on the same server (e.g. AWS RDS), DB1 and DB2. There are two users with some restrictions, and each user is assigned to a different database. US1 have access to DB1, ...
- 307
6
votes
1
answer
7k
views
Why can't I delete the default AWS security group?
There are no inbound nor outbound rules. It's an empty group. What use does it serve?
- 1,758
22
votes
2
answers
5k
views
How to use AWS KMS securely?
I am investigating using AWS KMS (Amazon Web Services Key Management Service) to decrypt an encrypted symmetric key (i.e: envelope encryption). However, to use the KMS, I need to pass it my amazon ...
- 415
28
votes
3
answers
5k
views
Pentesting against own web service hosted on 3rd party platform
I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
- 589
5
votes
1
answer
3k
views
How AWS access key id and secret access key are generated internally
According to AWS's documentation, for accessing AWS resources programmatically or via CLI, you can generate an access key in AWS console like:
Access Key ID: AKIAIOSFODNN7EXAMPLE
Secret Access Key: ...
- 151
4
votes
3
answers
3k
views
AWS S3 and 2-factor (multifactor)
I have a client looking to use AWS S3 buckets for file transfer to other clients. That data may have some sort of protected data in it.
I'd like to set up S3 to use 2-factor or MFA for the login/...
- 1,209
1
vote
2
answers
172
views
AWS HIPAA requires hardware dedicated to a single customer
Amazon HIPAA compliance requires customers to run on dedicated hardware (https://aws.amazon.com/compliance/hipaa-compliance/).
I would think isolation of the operating system and encryption of data ...
- 13
2
votes
1
answer
411
views
How much security does double VPN layer adds?
For doing ssh into our AWS infrastructure outside of office, we are required to connect to a VPN which gives us an office IP. Once we are connected to this VPN we are required to connect to another ...
- 21
4
votes
1
answer
543
views
How secure is http communication between AWS ELB and EC2 Instances
We have a VPC with security group set between AWS ELB and EC2 instances. However, when a request is forwarded to EC2 instances, we forward it via http, not https. Http being not encrypted and given ...
- 41
18
votes
2
answers
4k
views
What is the threat model for AWS EBS volumes encryption?
AWS provides the ability to encrypt EBS volumes, the value of which I am wondering about. In the "Overview of Security Processes (October 2016)" whitepaper, page 24, they say:
Encryption of ...
- 768
0
votes
2
answers
188
views
Private AES-GCM key
I'm using Amazon's (AWS) Key Management Service (KMS) to encrypt user data, the KMS uses AES-GCM cryptography.
My problem is that as the AES-GCM key is stored in the KMS and I, as an administrator ...
- 225
6
votes
1
answer
4k
views
Security of setting access to S3 bucket only from a particular website
I read about setting access to S3 bucket only from a particular website in Amazon Docs. And I quote :
Suppose you have a website with domain name (www.example.com or
example.com) with links to ...
- 163
4
votes
1
answer
17k
views
Amazon Elastic Load Balancer and mutual authentication
Has anyone configured AWS ELB (Elastic Load Balancer) to do mutual authentication (i.e., authenticate both the server and client), probably over TLS. We're exposing a REST API using SSH and a shared ...
- 41
1
vote
2
answers
148
views
AWS RDS MySQL database publically avalible
We currently have two EC2 instances and a RDS instance. Both a EC2 instance and the RDS instance a hosted on AWS in the same region. However, the second EC2 instance is on a different region.
...
- 111
5
votes
1
answer
3k
views
AWS-S3 Signed URL Security concern
When you create a pre-signed URL for your object, you must provide expiration date and time. The pre-signed URLs are valid only for the specified duration.
Anyone who receives the pre-signed URL can ...
- 51
1
vote
1
answer
1k
views
Pentesting a Data Warehouse?
One client has recently implemented AWS and has a EC2 instance running.
We have made one scoping call and further to that they provided me with a diagram that I have modified to avoid any issue:
The ...
- 59
13
votes
2
answers
16k
views
Best practices for managing AWS EC2 Key Pairs
Our organization uses Amazon Web Services (AWS), and we have multiple EC2 instances running in different subnets (VPCs) for different clients. Our application is in development and we have need to ...
- 263
7
votes
3
answers
31k
views
How can I kill minerd malware on an AWS EC2 instance? [duplicate]
I have an AWS EC2 instance running RHEL 7.2 which seems to have been hacked by a BitCoin CPU Miner. When I run ps -eo pcpu,args --sort=-%cpu | head, it shows that there is a CPU miner that's taking up ...
- 289
2
votes
2
answers
154
views
Am I vulnerable while leaving a putty client connected to my Amazon Web Server?
I'm not worried or concerned, but I am curious as to what types of exploitation I might expose my home server to if I leave a putty client connected using SSH.
I am using putty to connect to an EC2 ...
- 1,595
1
vote
1
answer
2k
views
AWS S3 Server-side Encryption - Client Provided Keys PHP
It is a bit strange to me this isn't a commonly discussed topic yet but I am working with an AWS S3 storage server trying to implement server-side encryption using the option of a client provided key (...
- 61
4
votes
2
answers
275
views
Data breach policy - immediate actions
We have a web application server and a database on AWS.
Is there any "immediate action" policy somewhere we can adopt as to the steps we can take when we suspect or detect a data breach?
- 153
10
votes
2
answers
6k
views
Is there any risk to enabling CORS with a wildcard on S3?
By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
- 101