🔷 Azure B2C: Crypto Misuse and Account Compromise

Microsoft's Azure Active Directory B2C service contained a cryptographic flaw which allowed an attacker to craft an OAuth refresh token with the contents for any user account. An attacker could redeem this refresh token for a session token, thereby gaining access to a victim account as if the attacker had logged in through a legitimate login flow.

https://www.praetorian.com/blog/azure-b2c-crypto-misuse-and-account-compromise

#azure

🔶 How Using Deprecated Policies Creates Overprivileged Permissions

AmazonEC2RoleforSSM, a deprecated version of the now recommended AmazonSSMManagedInstaceCore. This post breaks down why AWS likely deprecated the original policy and how organizations leave themselves vulnerable by continuing to use these deprecated policies.

https://permiso.io/blog/s/deprecated-aws-policy-amazonec2roleforSSM

#aws

🔷 Azure AD Kerberos Tickets: Pivoting to the Cloud

If you've ever been doing an Internal Penetration test where you've reached Domain Admin status and you have a cloud presence, your entire Azure cloud can still be compromised.

https://www.trustedsec.com/blog/azure-ad-kerberos-tickets-pivoting-to-the-cloud

#azure

🔶 6 Keys to Securing User Uploads to Amazon S3

How to architect AWS applications to securely enable user uploaded content, using pre-signed post URLs.

https://scalesec.com/blog/6-keys-to-securing-user-uploads-to-amazon-s3

#aws

🔷 Canarytokens welcomes Azure Login Certificate Token

Canarytokens.org introduced the Azure Login Certificate Token (aka the Azure Token). You can sprinkle Azure tokens throughout your environment and receive high fidelity notifications whenever they're used.

https://blog.thinkst.com/2023/02/canarytokens-org-welcomes-azure-login-certificate-token.html

#azure

🔶 A role for all your EC2 instances

You can now pass an IAM role to every EC2 instance in your account + region.

https://awsteele.com/blog/2023/02/20/a-role-for-all-your-ec2-instances.html

#aws

🔶 My CI/CD pipeline is my release captain

How Amazon continuously release changes to production by practicing trunk-based development, by using CI/CD pipelines to manage deployment artifacts and coordinate releases across multiple production environments, and by practicing proactive and automatic rollbacks.

https://aws.amazon.com/ru/builders-library/cicd-pipeline

#aws

🔴 Securing Cloud Run Deployments with Least Privilege Access

How to protect your Cloud Run deployments by implementing least privilege access for Cloud Run services and service consumers.

https://cloud.google.com/blog/products/identity-security/securing-cloud-run-deployments-with-least-privilege-access

#gcp

🔶 automated-ci-pipeline-creation

Creation of Continuous Integration pipelines dynamically using an AWS Step Function based approach to create standardised pipelines for an organisation.

https://github.com/aws-samples/automated-ci-pipeline-creation

#aws

🔴 How Attackers Can Exploit GCP's Multicloud Workload Solution

A deep dive into the inner workings of GCP Workload Identity Federation, taking a look at risks and how to avoid misconfigurations.

https://ermetic.com/blog/gcp/how-attackers-can-exploit-gcps-multicloud-workload-solution

#gcp

🔶🔴 Five Things You Need to Know About Malware on Storage Buckets

An overview of malware in cloud storage buckets and mitigation best practices.

https://orca.security/resources/blog/the-risks-of-malware-in-storage-buckets

#aws #gcp

🔶 AWS EC2 IMDS - What You Need to Know

A technical review of IMDSv2.

https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know

#aws

🔶 staticwebsite-cli

This CLI tool makes it easy to deploy a static website to AWS. It builds and hosts the website, sets up a CDN and DNS, and provisions an SSL certificate.

https://github.com/awslabs/staticwebsite-cli

#aws

🔷 Preview support for Kata VM Isolated Containers on AKS for Pod Sandboxing

Azure Kubernetes Service (AKS) now supports pod sandboxing in preview in all Azure regions on a subset of Azure VM Sizes that support Nested Virtualization.

https://techcommunity.microsoft.com/t5/apps-on-azure-blog/preview-support-for-kata-vm-isolated-containers-on-aks-for-pod/ba-p/3751557

#azure

🔴 Google Cloud Platform Exfiltration: A Threat Hunting Guide

Some security gaps that every organization using GCP should be aware of in order to protect itself from data exfiltration.

https://www.mitiga.io/blog/google-cloud-platform-exfiltration-a-threat-hunting-guide

#gcp

🔷 Pivoting with Azure Automation Account Connections

How Automation Accounts handle authenticating as other accounts within a runbook, and how to abuse those authentication connections to pivot to other Azure resources.

https://www.netspi.com/blog/technical/cloud-penetration-testing/azure-automation-account-connections

#azure

🔶 Understanding the Integration Between KMS and Secrets Manager on AWS

Post covering the integration between KMS and Secrets Manager on AWS, to better understand how they work.

https://blog.lightspin.io/understanding-the-integration-between-kms-and-secrets-manager-on-aws

#aws

🔶 A New Incentive for Using AWS VPC Endpoints

If you haven't been using VPC endpoints until now, AWS's two new condition keys should make you consider doing so.

https://ermetic.com/blog/aws/a-new-incentive-for-using-aws-vpc-endpoints

#aws

🔶 Reducing Attack Surface with AWS Allowlisting

A detailed look at implementing Region and Service allowlisting in AWS.

https://ramimac.me/aws-allowlisting

#aws

🔴 Monitoring Kubernetes Clusters on GKE

A hands-on guide to monitoring and logging at different layers in the GKE stack.

https://medium.com/google-cloud/gke-monitoring-84170ea44833

#gcp

🔶 Passwordless Authentication made easy with Cognito

A Step-by-Step Guide, including working demo and complete source code for both frontend and backend.

https://theburningmonk.com/2023/03/passwordless-authentication-made-easy-with-cognito-a-step-by-step-guide

#aws