🔷 ChaosDB Explained: Azure’s Cosmos DB Vulnerability Walkthrough

Great walkthrough example of exploring attack surface, escalating privileges, and lateral movement by Wiz’s Nir Ohfeld and Sagi Tzadik.

https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough

#azure

🔴 Everything you always wanted to know about VPC Peering (but were afraid to ask)

An overview of Google Cloud VPC network peerings, their anatomy, major misconceptions, and some watchpoints, so that users can learn how to use them wisely, while designing their infrastructures.

https://medium.com/google-cloud/everything-you-always-wanted-to-know-about-vpc-peering-but-were-afraid-to-ask-2b26267ba7d9

#gcp

🔷 Exploiting and defending anonymous access in Azure

Most of Azure services require some form of authentication for access. However, there are a few exceptions that allows the configuration of unauthenticated and unauthorized access. The most common ones are the Azure Blob Container and the Azure Container registry.

https://davidokeyode.medium.com/exploiting-and-defending-anonymous-access-in-azure-dcb00e032258

#azure

🔶 tenchi-security/camp

A tool that automatically downloads and keeps a local copy of all AWS IAM Managed Policies, and runs Cloudsplaining on them. By Victor Grenu and Tenchi Security’s Alexandre Sieira.

https://github.com/tenchi-security/camp

#aws

🔶 Do not use AWS CloudFormation

Greg Swallow argues that CloudFormation is strictly worse than Terraform: it has extra indirection and is harder to debug, Terraform has a rich set of data sources and makes transforming data is a breeze, Terraform is much faster, CloudFormation’s async nature requires polling logic, Terraform is portable across providers, and more.

https://gswallow.medium.com/do-not-use-aws-cloudformation-7cf61f58bd5f

#aws

🔶 Well, That Escalated Quickly

AfterPay’s Dorien Koelemeijer describes Cloud Cover, a tool they built to enable developers to move quickly but also with least IAM privilege, using Okta, permissions defined in a git repo, and more. Neat approach.

https://www.afterpaytechblog.com/well-that-escalated-quickly/

#aws

🔷 CVE-2021-42306 CredManifest: App Registration Certificates Stored in Azure Active Directory

Another security issue discovered in Azure: due to a misconfiguration, Automation Account "Run as" credentials (PFX certificates) were being stored in cleartext in Azure Active Directory (AAD).

https://www.netspi.com/blog/technical/cloud-penetration-testing/azure-cloud-vulnerability-credmanifest/

#azure

🔶 Identity Federation for GitHub Actions on AWS

An useful step-by-step example on how to configure your GitHub Actions build jobs to securely and seamlessly use IAM Roles in AWS.

https://scalesec.com/blog/identity-federation-for-github-actions-on-aws/

#aws

🔶 Effective IAM for AWS: A guide to realize IAM best practices

Learn how to secure AWS with usable IAM architecture, policies, and automation that scales security best practices efficiently to all developers.

https://www.effectiveiam.com/

#aws

🔶 Updates to IAM policy evaluation logic flow chart

AWS has finally updated the documentation around determining whether a request is allowed or denied within an account.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow

#aws

🔷 Modernizing compliance: Introducing Risk and Compliance as Code

Google announced the launch of their Risk and Compliance as Code (RCaC) Solution. The RCaC solution stack enables compliance and security control automation through a combination of Google Cloud Products, Blueprints, Partner Integrations, workshops and services.

https://cloud.google.com/blog/products/identity-security/risk-and-compliance-as-code

#azure

🔶 pre:Invent 2021

There were 234 AWS announcements in pre:Invent season. Chris Farris analysed 27 of them related to security and governance.

https://www.chrisfarris.com/post/preinvent2021/

#aws

🔶🔷🔴 AWS/Azure/GCP Permissions

Continuing with efforts on the permissions.cloud project, Ian Mckay has now have both Azure and GCP spaces available: azure.permissions.cloud and gcp.permissions.cloud.

https://aws.permissions.cloud/

#aws #azure #gcp

🔶 Is AWS Recycling your Access Keys?

Temporary AWS API access key IDs, issued by AWS, are not unique and could repeat, which can impair AWS security tools detection capabilities.

https://www.hunters.ai/blog/hunters-research-is-aws-recycling-your-access-keys

#aws

🔶 twistlock/splash

By Palo Alto Networks’s Yuval Avrahami: A pseudo shell re-invoking the Lambda for each command. For curious fellows who want to hack on AWS Lambda’s infrastructure.

https://github.com/twistlock/splash

#aws

🔴 Illicit coin mining, ransomware, APTs target cloud users in first Google Cybersecurity Action Team Threat Horizons report

The first threat report from the Google Cybersecurity Action Team finds cloud users are often targeted by illicit coin mining, ransomware, and APTs.

https://cloud.google.com/blog/products/identity-security/coin-mining-ransomware-apts-target-cloud-gcat-report

#gcp

🔷 Azure Privilege Escalation via Azure API Permissions Abuse

How Azure API Permissions can be abused to escalate to Global Admin.

https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48

#azure

🔶 Data Perimeter Workshop

This workshop takes you through some of the best practices and available AWS services and features for creating a boundary around your resources in AWS.

https://data-perimeter.workshop.aws/

#aws

🔶 IAM roles for Kubernetes service accounts - deep dive

How IAM and Kubernetes work together allowing you to call AWS services from your pods with no hussle.

https://mjarosie.github.io/dev/2021/09/15/iam-roles-for-kubernetes-service-accounts-deep-dive.html

#aws

🔶 AWS Policy as Code Workshop

This workshop explores how to codify a set of rules that make up a policy, use a DevSecOps workflow to quickly address policy issues, and redeploy a policy compliant workload.

https://catalog.us-east-1.prod.workshops.aws/v2/workshops/9da471a0-266a-4d36-8596-e5934aeedd1f/en-US/

#aws

🔶🔷🔴 Cloud service provider security mistakes

Cloud historian Scott Piper has created a GitHub repo to catalogue security mistakes by cloud service providers (AWS, GCP, and Azure); that is, public mistakes on the cloud providers’ side of the shared responsibility model. Includes CVEs, SOC 2 Type 2 failures, security researchers compromising managed services, and more.

https://github.com/SummitRoute/csp_security_mistakes

#aws #azure #gcp