🔶 A small digest of AWS news:

1️⃣ AWS Control Tower launches managed controls using declarative policies

These policies are a set of new optional controls that help you consistently enforce the desired configuration for a service.

2️⃣ AWS Config now supports a service-linked recorder

AWS Config added support for a service-linked recorder, a new type of AWS Config recorder that is managed by an AWS service and can record configuration data on service-specific resources, such as the new Amazon CloudWatch telemetry configurations audit.

(Use VPN to open from Russia)

#aws

🙂 Dear friends,
this year we have already become more than 2000 people. And this is very cool.

Only thanks to you we will make even cooler content. Thank you very much.

🎉 Happy New Year 2025! We wish you success in your personal life and career. Let's make the new year much better than 2024 together!

#HappyNewYear

🔶 hidden-services-revealer

A tool to map hidden services in AWS. It does this by following the triggered events of a user's actions.

https://github.com/tenable/hidden-services-revealer

#aws

🔶🔴 cloudranger

Go library for mapping IP address ranges to cloud provider regions (currently: AWS and GCP).

https://github.com/planetscale/cloudranger

#aws #gcp

🔶 safer-scps

Safer AWS Service Control Policies (SCPs) deployments via real-time error monitoring.

https://github.com/matthewdfuller/safer-scps

#aws

🔴 The dark cloud around GCP service accounts

Why does this service account still have access even though I deleted its service account key?

https://redcanary.com/blog/threat-detection/gcp-service-accounts/

#gcp

🔶 Hat Trick: AWS introduced same RCE vulnerability three times in four years

Amazon has introduced the same dependency confusion issue at least on 3 separate occasions when adding new packages to the Neuron SDK registry.

https://giraffesecurity.dev/posts/amazon-hat-trick/

#aws

🔶 From Detection to Enforcement: Migrating from IMDSv1 to IMDSv2

Concrete advice on approaching a migration to IMDSv2.

https://securitylabs.datadoghq.com/articles/from_detection_to_enforcement_migrating_from_imdsv1_to_imdsv2/

#aws

🔶 The many ways to obtain credentials in AWS

Post exploring how AWS services provide IAM credentials, and teaching key risks and detection strategies to secure your cloud environment against credential misuse.

https://www.wiz.io/blog/the-many-ways-to-obtain-credentials-in-aws

#aws

🔶 Avoiding mistakes with AWS OIDC integration conditions

Post exploring some common missteps in securing your AWS OIDC.

https://www.wiz.io/blog/avoiding-mistakes-with-aws-oidc-integration-conditions

#aws

🔶 Implementing Security Invariants in an AWS Management Account

Chris Farris discusses the implementation of security invariants within an AWS management account, specifically the payer account where organizational policies do not apply.

https://www.chrisfarris.com/post/payer-invariants/

#aws

🔶 AWS CodeBuild: Self-Hosted GitHub Action Runners

How to set up AWS CodeBuild for GitHub Action Runners, including configuration steps and integration advantages.

https://kieranlowe.io/implementing-self-hosted-github-action-runners-using-aws-codebuild

#aws

🔶 How to share security telemetry per OU using Amazon Security Lake and AWS Lake Formation

How to extract OU structure and account metadata from your organization and use it to securely share Security Lake data on a per-OU basis across your organization.

https://aws.amazon.com/ru/blogs/security/how-to-share-security-telemetry-per-ou-using-amazon-security-lake-and-aws-lake-formation/

(Use VPN to open from Russia)

#aws

🔶 How to bypass honeypots in AWS

This post suggests a way to detect and avoid honeypots set up for access key IDs in an AWS environment.

https://tejaszarekar.gitbook.io/tejaszarekar

#aws

🔶 Terraform S3 Backend Setup: Skip the Table

It is now possible to remove DynamoDB as a dependency, and streamline your S3 backend setup.

https://kieranlowe.io/terraform-s3-backend-setup-skip-the-table

#aws

🔴 Securing Grafana on Kubernetes

A step-by-step guide to secure a Grafana deployment on Kubernetes using Google Cloud Identity-Aware Proxy (GCP IAP), Gateway API, and Terraform.

https://www.vidbregar.com/blog/grafana-gcp-iap

#gcp