🔶 Streamline Fifteen SOC 2 Controls with AWS Config and AWS Security Hub

There are two services on AWS that can make SOC 2 easier for you and your company, AWS Config and AWS Security Hub. These two services have built-in rules (Config) and controls (Security Hub) that directly address SOC 2 criteria and controls.

https://www.sans.org/blog/streamline-fifteen-soc-2-controls/

#aws

🔴 The 2 limits of Google Cloud IAM

2 use cases where the GCP IAM model is limited, requiring some trickery to get right.

https://www.iampulse.com/t/the-2-limits-of-google-cloud-iam

#gcp

🔶 Automating cloud governance at scale

Blog post from SkyScanner, introducing some recent improvements to CFRipper that have enabled them to detect issues more accurately, allow for increasing levels of customization, and facilitate dynamic stack exemptions for engineering squads.

https://medium.com/@SkyscannerEng/automating-cloud-governance-at-scale-895695fe4a1f

#aws

🔶 Using New S3 Features to Give CloudTrail Logs Service-Side Enrichment

Use the recent S3 Object Lambda functionality in AWS to enrich S3-based logs with valuable intelligence.

https://www.paloaltonetworks.com/blog/security-operations/enrich-aws-cloudtrail-s3-object-lambda/

#aws

🔷 ChaosDB Explained: Azure’s Cosmos DB Vulnerability Walkthrough

Great walkthrough example of exploring attack surface, escalating privileges, and lateral movement by Wiz’s Nir Ohfeld and Sagi Tzadik.

https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough

#azure

🔴 Everything you always wanted to know about VPC Peering (but were afraid to ask)

An overview of Google Cloud VPC network peerings, their anatomy, major misconceptions, and some watchpoints, so that users can learn how to use them wisely, while designing their infrastructures.

https://medium.com/google-cloud/everything-you-always-wanted-to-know-about-vpc-peering-but-were-afraid-to-ask-2b26267ba7d9

#gcp

🔷 Exploiting and defending anonymous access in Azure

Most of Azure services require some form of authentication for access. However, there are a few exceptions that allows the configuration of unauthenticated and unauthorized access. The most common ones are the Azure Blob Container and the Azure Container registry.

https://davidokeyode.medium.com/exploiting-and-defending-anonymous-access-in-azure-dcb00e032258

#azure

🔶 tenchi-security/camp

A tool that automatically downloads and keeps a local copy of all AWS IAM Managed Policies, and runs Cloudsplaining on them. By Victor Grenu and Tenchi Security’s Alexandre Sieira.

https://github.com/tenchi-security/camp

#aws

🔶 Do not use AWS CloudFormation

Greg Swallow argues that CloudFormation is strictly worse than Terraform: it has extra indirection and is harder to debug, Terraform has a rich set of data sources and makes transforming data is a breeze, Terraform is much faster, CloudFormation’s async nature requires polling logic, Terraform is portable across providers, and more.

https://gswallow.medium.com/do-not-use-aws-cloudformation-7cf61f58bd5f

#aws

🔶 Well, That Escalated Quickly

AfterPay’s Dorien Koelemeijer describes Cloud Cover, a tool they built to enable developers to move quickly but also with least IAM privilege, using Okta, permissions defined in a git repo, and more. Neat approach.

https://www.afterpaytechblog.com/well-that-escalated-quickly/

#aws

🔷 CVE-2021-42306 CredManifest: App Registration Certificates Stored in Azure Active Directory

Another security issue discovered in Azure: due to a misconfiguration, Automation Account "Run as" credentials (PFX certificates) were being stored in cleartext in Azure Active Directory (AAD).

https://www.netspi.com/blog/technical/cloud-penetration-testing/azure-cloud-vulnerability-credmanifest/

#azure

🔶 Identity Federation for GitHub Actions on AWS

An useful step-by-step example on how to configure your GitHub Actions build jobs to securely and seamlessly use IAM Roles in AWS.

https://scalesec.com/blog/identity-federation-for-github-actions-on-aws/

#aws

🔶 Effective IAM for AWS: A guide to realize IAM best practices

Learn how to secure AWS with usable IAM architecture, policies, and automation that scales security best practices efficiently to all developers.

https://www.effectiveiam.com/

#aws

🔶 Updates to IAM policy evaluation logic flow chart

AWS has finally updated the documentation around determining whether a request is allowed or denied within an account.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow

#aws

🔷 Modernizing compliance: Introducing Risk and Compliance as Code

Google announced the launch of their Risk and Compliance as Code (RCaC) Solution. The RCaC solution stack enables compliance and security control automation through a combination of Google Cloud Products, Blueprints, Partner Integrations, workshops and services.

https://cloud.google.com/blog/products/identity-security/risk-and-compliance-as-code

#azure

🔶 pre:Invent 2021

There were 234 AWS announcements in pre:Invent season. Chris Farris analysed 27 of them related to security and governance.

https://www.chrisfarris.com/post/preinvent2021/

#aws

🔶🔷🔴 AWS/Azure/GCP Permissions

Continuing with efforts on the permissions.cloud project, Ian Mckay has now have both Azure and GCP spaces available: azure.permissions.cloud and gcp.permissions.cloud.

https://aws.permissions.cloud/

#aws #azure #gcp

🔶 Is AWS Recycling your Access Keys?

Temporary AWS API access key IDs, issued by AWS, are not unique and could repeat, which can impair AWS security tools detection capabilities.

https://www.hunters.ai/blog/hunters-research-is-aws-recycling-your-access-keys

#aws

🔶 twistlock/splash

By Palo Alto Networks’s Yuval Avrahami: A pseudo shell re-invoking the Lambda for each command. For curious fellows who want to hack on AWS Lambda’s infrastructure.

https://github.com/twistlock/splash

#aws

🔴 Illicit coin mining, ransomware, APTs target cloud users in first Google Cybersecurity Action Team Threat Horizons report

The first threat report from the Google Cybersecurity Action Team finds cloud users are often targeted by illicit coin mining, ransomware, and APTs.

https://cloud.google.com/blog/products/identity-security/coin-mining-ransomware-apts-target-cloud-gcat-report

#gcp

🔷 Azure Privilege Escalation via Azure API Permissions Abuse

How Azure API Permissions can be abused to escalate to Global Admin.

https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48

#azure