🔶 The AWS S3 Denial of Wallet amplification attack

If you publicly host large data files on AWS S3 and pay for AWS transfer costs, you may be vulnerable to a «Denial of Wallet» amplification attack.

https://blog.limbus-medtec.com/the-aws-s3-denial-of-wallet-amplification-attack-bc5a97cc041d

(Use VPN to open from Russia)

#aws

🔶 Introducing the AWS WAF traffic overview dashboard

Post introducing the new dashboards and delve into a few use cases to help you gain better visibility into the overall security of your applications using AWS WAF and make informed decisions based on insights from the dashboards.

https://aws.amazon.com/ru/blogs/security/introducing-the-aws-waf-traffic-overview-dashboard/

#aws

🔶 The Missing Guide to AWS API Gateway Access Logs

Learn the what, why, and how of API Gateway access logs.

https://www.alexdebrie.com/posts/api-gateway-access-logs/

#aws

🔴 Introducing Security Command Center Enterprise

Security Command Center Enterprise is the first multicloud risk management solution that fuses AI-powered SecOps with cloud security.

https://cloud.google.com/blog/products/identity-security/introducing-security-command-center-enterprise

#gcp

🔶 How we sped up AWS CloudFormation deployments with optimistic stabilization

Post discussing the new optimistic stabilization strategy to shorten stack deployment times and improve visibility into resource provisioning.

https://aws.amazon.com/ru/blogs/devops/how-we-sped-up-aws-cloudformation-deployments-with-optimistic-stabilization/

#aws

🔴 Use customer-managed encryption keys

How to use a Cloud Key Management Service (Cloud KMS) encryption key with Dataflow.

https://cloud.google.com/dataflow/docs/guides/customer-managed-encryption-keys

#gcp

🔶 Tales from the cloud trenches: Using malicious AWS activity to spot phishing campaign

How the tracking of AWS Simple Notification Service (SNS) enumeration activity across multiple customer environments led to the takedown of a phishing site that was impersonating the French government.

https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-aws-activity-to-phishing/

#aws

🔴 How to set compliance controls for your Google Cloud Organization

Assured Workloads can help you ensure comprehensive data protection and regulatory compliance with folders that support your compliance requirements.

https://cloud.google.com/blog/products/identity-security/how-to-set-compliance-controls-for-your-google-cloud-organization/

#gcp

🔴 Introducing stronger default Org Policies for our customers

Google Cloud is releasing an updated and stronger set of security defaults that can be implemented with Organizational Policies.

https://cloud.google.com/blog/products/identity-security/introducing-stronger-default-org-policies-for-our-customers/

#gcp

🔶 DynamoDB now supports resource-based policies. But is that a good idea?

While it simplifies cross-account access to DynamoDB tables, eliminating the need to assume IAM roles. It still begs the question: Is cross-account data access even a good idea?

https://theburningmonk.com/2024/03/dynamodb-now-supports-resource-based-policies-but-is-that-a-good-idea/

#aws

🔶 Ultimate guide to secrets in Lambda

This post compares Systems Manager, Secrets Manager, Key Management Service, and environment variables for handling your secrets in Lambda.

https://aaronstuyvenberg.com/posts/ultimate-lambda-secrets-guide

#aws

🔶 Use Amazon Verified Permissions for fine-grained authorization at scale

How you can apply 2 techniques (bulk authorization and response caching) when listing authorized resources and actions and loading multiple components on webpages.

https://aws.amazon.com/ru/blogs/security/use-amazon-verified-permissions-for-fine-grained-authorization-at-scale/

#aws

🔶 Set IMDSv2 as default for all new instance launches in your account

You can now set all new Amazon EC2 instance launches in your account to use Instance Metadata Service Version 2 (IMDSv2) by default.

https://aws.amazon.com/ru/about-aws/whats-new/2024/03/set-imdsv2-default-new-instance-launches/

#aws

🔶🔴 Leveraging AWS SSO (aka Identity Center) with Google Workspaces

How to configure AWS Identity Center to use Google Workspace/Cloud Identity with SCIM Support.

https://www.primeharbor.com/blog/aws-identity-center-google/

#aws #gcp

🔶 When AWS invariants aren't [invariant]

Search CloudTrail for instances of AssumeRole with additionalEventData.explicitTrustGrant == false. These will yield results for role assumptions that aren't permitted by the trust policy and violate your invariants like role session names will always be an employee's email address.

https://awsteele.com/blog/2024/02/20/when-aws-invariants-are-not.html

#aws