🔶🔴 Leveraging AWS SSO (aka Identity Center) with Google Workspaces

How to configure AWS Identity Center to use Google Workspace/Cloud Identity with SCIM Support.

https://www.primeharbor.com/blog/aws-identity-center-google/

#aws #gcp

🔶 When AWS invariants aren't [invariant]

Search CloudTrail for instances of AssumeRole with additionalEventData.explicitTrustGrant == false. These will yield results for role assumptions that aren't permitted by the trust policy and violate your invariants like role session names will always be an employee's email address.

https://awsteele.com/blog/2024/02/20/when-aws-invariants-are-not.html

#aws

🔶 How to generate security findings to help your security team with incident response simulations

How to deploy a solution that provisions resources to generate simulated security findings for actual provisioned resources within your AWS account.

https://aws.amazon.com/ru/blogs/security/how-to-generate-security-findings-to-help-your-security-team-with-incident-response-simulations/

#aws

🔶 Amazon GuardDuty EC2 Runtime Monitoring is now generally available

Amazon announced the general availability of Amazon GuardDuty EC2 Runtime Monitoring to expand threat detection coverage for EC2 instances at runtime and complement the anomaly detection that GuardDuty already provides by continuously monitoring VPC Flow Logs, DNS query logs, and AWS CloudTrail management events.

https://aws.amazon.com/ru/blogs/aws/amazon-guardduty-ec2-runtime-monitoring-is-now-generally-available/

#aws

🔶 Terraform CI/CD and testing on AWS with the new Terraform Test Framework

How to validate Terraform modules and how to automate the process using a CI/CD pipeline.

https://aws.amazon.com/ru/blogs/devops/terraform-ci-cd-and-testing-on-aws-with-the-new-terraform-test-framework/

#aws

🔴 Who Touched My GCP Project? Understanding the Principal Part in Cloud Audit Logs

Post which explains how to identify principles and understand the identities present in GCP logs, including impersonation and third-party identities.

https://www.mitiga.io/blog/who-touched-my-gcp-project-understanding-the-principal-part-in-cloud-audit-logs-part-1

#gcp

🔶 Muddled Libra's Evolution to the Cloud

Unit 42 researchers have discovered that the Muddled Libra group now actively targets software-as-a-service (SaaS) applications and cloud service provider (CSP) environments.

https://unit42.paloaltonetworks.com/muddled-libra-evolution-to-cloud/

#aws

🔶 We discovered an AWS access vulnerability

The Stedi team discovered a vulnerability in STS that caused role trust policy statements to be evaluated incorrectly.

https://www.stedi.com/blog/stedi-discovered-an-aws-access-vulnerability

#aws

🔶 Detecting and remediating inactive user accounts with Amazon Cognito

A solution that uses serverless technologies to track and disable inactive user accounts.

https://aws.amazon.com/ru/blogs/security/detecting-and-remediating-inactive-user-accounts-with-amazon-cognito/

#aws

🔶 Amazon AppFlow vulnerabilities: Undocumented API allowed reading partial secrets, SSRF in WooCommerce connector

This vulnerability allowed anyone to steal secrets managed by AppFlow in any AWS account.

https://ronin.ae/news/amazon-appflow-vulnerabilities/

#aws

🔶 S3 Bucket Encryption Doesn't Work The Way You Think It Works

Let's try all the different S3 encryption options, see why it's more like access control than encryption, and why that matters.

https://blog.plerion.com/s3-bucket-encryption-doesnt-work-the-way-you-think-it-works/

#aws

🔶 Integrate Kubernetes policy-as-code solutions into Security Hub

A solution to send policy violations from PaC solutions using Kubernetes policy report format (for example, using Kyverno) or from Gatekeeper's constraints status directly to AWS Security Hub.

https://aws.amazon.com/ru/blogs/security/integrate-kubernetes-policy-as-code-solutions-into-security-hub/

(Use VPN to open from Russia)

#aws

🔶 Our Journey Migrating to AWS IMDSv2

Slack moved their entire fleet and tools to IMDSv2. In this article, they discuss the pitfalls of using IMDSv1 and their journey towards fully migrating to IMDSv2.

https://slack.engineering/our-journey-migrating-to-aws-imdsv2/

#aws

🔶 Using an Undocumented Amplify API to Leak AWS Account IDs

Writeup for a technique that allowed to leak an AWS account ID from an Amplify app.

https://frichetten.com/blog/undocumented-amplify-api-leak-account-id/

#aws

🔶 npk

NPK is a distributed hash-cracking platform built entirely of serverless components in AWS including Cognito, DynamoDB, and S3. It was designed for easy deployment and the intuitive UI brings high-power hash-cracking to everyone.

https://github.com/c6fc/npk

#aws