🔶 AWS Security Groups Guide

Knowing how security groups & NACLs work together is extremely important for controlling network traffic to your instances & subnets.

https://sysdig.com/blog/aws-security-groups-guide

(Use VPN if you can’t open it)

#aws

🔶 flosell/trailscraper

By Thoughtworks’s Florian Sellmayr: A command-line tool to get valuable information out of AWS CloudTrail and a general purpose toolbox for working with IAM policies.

https://github.com/flosell/trailscraper

#aws

🔴 Announcing Sensitive Actions to help keep accounts secure

Google introduced Sensitive Actions, a new way to understand user account behaviour. They are changes made in a Google Cloud environment that are security relevant, and therefore important to be aware of and evaluate.

https://cloud.google.com/blog/products/identity-security/announcing-sensitive-actions-to-help-keep-accounts-secure

#gcp

🔶 cloudandthings/terraform-aws-clickops-notifier

Get notified when users are taking actions in the AWS Console.

https://github.com/cloudandthings/terraform-aws-clickops-notifier

#aws

🔶 Use IAM Access Analyzer policy generation to grant fine-grained permissions for your AWS CloudFormation service roles

IAM Access Analyzer policy generation creates fine-grained policies based on your AWS CloudTrail access activity—for example, the actions you use with ECS, Lambda and S3. AWS has expanded policy generation capabilities to support the identification of actions used from over 140 services, including CloudFormation, DynamoDB, and SQS.

https://aws.amazon.com/ru/blogs/security/use-iam-access-analyzer-policy-generation-to-grant-fine-grained-permissions-for-your-aws-cloudformation-service-roles

🔷 CosMiss: Azure Cosmos DB Vulnerability

The Orca Research team has discovered CosMiss, a vulnerability in Microsoft Azure Cosmos DB where authentication checks were missing from Cosmos DB Notebooks.

https://orca.security/resources/blog/cosmiss-vulnerability-azure-cosmos-db

#azure

🔶🔴 Exploiting Static Site Generators: When Static Is Not Actually Static

The Assetnote security research team found vulnerabilities in static site generators (such as GatsbyJS and NextJS) and associated platforms (Netlify and GatsbyJS Cloud), which enabled SSRF.

https://blog.assetnote.io/2022/10/28/exploiting-static-site-generators

#aws #gcp

🔶 Internet Egress Filtering of Services at Lyft

How the Security team of Lyft achieved egress network traffic filtering for all their services.

https://eng.lyft.com/internet-egress-filtering-of-services-at-lyft-72e99e29a4d9?gi=983e70aa4ceb

#aws

🔶 Vault DR with AWS Lambda for Sub-Minute Recovery

How YNAP used AWS Lambda functions to reduce the disaster recovery time for HashiCorp Vault to mere seconds.

https://www.hashicorp.com/resources/vault-dr-with-aws-lambda-for-sub-minute-recovery

#aws

🔶 AWS security assessment: what scanners are missing and how threat modeling may help you?

SoftServe’s Pawel Rzepa discusses what scanners are missing and why he think tools cannot fully replace a human assessor in performing an effective AWS security assessment. Key points: scanners lack context, more findings don’t mean a better result, scanners may have security check gaps, skipped data flows and relations. Address these gaps via threat modeling.

https://towardsaws.com/aws-security-assessment-what-scanners-are-missing-and-how-threat-modeling-may-help-you-6a76c1c843f3

#aws

🔷 Bypassing Azure AD home tenant MFA and CA

Because of the Azure AD authentication platform architecture, users can bypass home tenant MFA and CA policies when logging in directly to resource tenants.

https://aadinternals.com/post/ests

#azure

🔶 An AWS account just for getting into other AWS accounts

This is the AWS account that makes having lots of AWS accounts efficient and safe. It's the most important account in your organization.

https://src-bin.com/an-aws-account-just-for-getting-into-other-aws-accounts

#aws

🔶 FivexL's Reaction to the AWS Security Baseline for Startups

FivexL shares its outlook on AWS Security Guidelines for startups. Find out how to improve your AWS security efficiently.

https://fivexl.io/blog/fivexl-reaction

#aws

🔶 AWS Network Firewall Workshop

A workshop teaching how to deploy Network Firewall using infrastructure as code.

https://catalog.us-east-1.prod.workshops.aws/workshops/58df66b5-ffd5-42dc-9e2c-d5a8ebe360d8/en-US

#aws

🔶 onemorepereira/aws-sso-reporter

A tool that uses the AWS SSO API to list all users, accounts, permission sets etc. and dumps it into a CSV file for additional parsing or viewing.

https://github.com/onemorepereira/aws-sso-reporter

#aws

🔷 Token tactics: How to prevent, detect, and respond to cloud token theft

As organizations increase their coverage of multifactor authentication (MFA), threat actors have begun to move to more sophisticated techniques to allow them to compromise corporate resources without needing to satisfy MFA. Recently, the Microsoft Detection and Response Team (DART) has seen an increase in attackers utilizing token theft for this purpose.

https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft

#azure

🔶 Infosys leaked FullAdminAccess AWS keys on PyPi for over a year

They appear to issue AWS keys to developers that are not rotated for several years and store these keys in git. They also don't have a clear place to report security issues like this.

https://tomforb.es/infosys-leaked-fulladminaccess-aws-keys-on-pypi-for-over-a-year

#aws

🔷 Abusing tcp tunneling in Azure Bastion

How Azure Bastion Native Client support works, and how an adversary could abuse this feature to perform attacks against Azure VMs over private IP addresses, without having direct network connectivity to the VM.

https://codyburkard.com/blog/bastionabuse

#azure

🔶 The Many Ways to Access RDS

An overview of RDS access management capabilities along with examples using Terraform.

https://blog.symops.com/2022/11/17/rds-access

#aws

🔷 Layers Of Cloud Azure And The Mis Storage Of Secrets

Ever wondered how storing secrets in the cloud can go wrong? This talk by Katie Knowles at BSides Toronto 2022 looks at common ways passwords should be stored.

https://youtu.be/SmxEvVg6Fe8

#azure

🔶 A Confused Deputy Vulnerability in AWS AppSync

A cross-tenant vulnerability in AWS AppSync, which allowed an attacker to access data in victims' accounts.

https://securitylabs.datadoghq.com/articles/appsync-vulnerability-disclosure

#aws