🔸The power of orchestration: how we automated enrichments for AWS alerts

How the Expel team automated enrichments for AWS alerts, with this blog sharing their approach to developing AWS enrichments and the implementation of the enrichment workflow process.

https://expel.io/blog/power-of-orchestration-how-we-automated-enrichments-aws-alerts/

#aws

🔸Privilege Escalation in AWS Elastic Kubernetes Service (EKS) by compromising the instance role of worker nodes

"In this post, we discuss the risks of the AWS Instance Metadata service in AWS Elastic Kubernetes Service (EKS) clusters. In particular, we demonstrate that compromising a pod in the cluster can have disastrous consequences on resources in the AWS account if access to the Instance Metadata service is not explicitly blocked."

https://blog.christophetd.fr/privilege-escalation-in-aws-elastic-kubernetes-service-eks-by-compromising-the-instance-role-of-worker-nodes/

by @mobile_appsec_world

#aws

🔹Become an Azure Security Center Ninja

This blog post has a curation of many Azure Security Center (ASC) resources, organized in a format that can help you to go from absolutely no knowledge in ASC, to design and implement different scenarios. You can use this blog post as a training roadmap to learn more about Azure Security Center.


https://techcommunity.microsoft.com/t5/azure-security-center/become-an-azure-security-center-ninja/ba-p/1608761

#azure

🔸AWS Penetration Testing with Kali Linux

Key Features:
- Efficiently perform penetration testing techniques on your public cloud instances
- Learn not only to cover loopholes but also to automate security monitoring and alerting within your cloud-based deployment pipelines
- A step-by-step guide that will help you leverage the most widely used security platform to secure your AWS Cloud environment

#aws

🔸Use HashiCorp Vault AWS engine with multiple accounts

Post breaking down how the Vault secrets engine works and how to use it to dynamically create credentials across multiple AWS accounts using the assume_role feature.

https://nedinthecloud.com/2020/08/29/use-hashicorp-vault-aws-engine-with-multiple-accounts/

#aws

🔸S3Insights: Derive insights about your S3 environment at scale

More neat work from Uber’s Ashish Kurmi (See also: How Uber Continuously Monitors the Security of its AWS Environment). S3Insights is a platform for efficiently deriving security insights about S3 data through system metadata analysis. Rather than analyzing the content of individual objects, S3Insights harvests S3 inventory data from multiple buckets in a multi-account environment to help discover and manage sensitive data.

#aws

🔸Record AWS API calls to improve IAM Policies

Have you ever looked at an IAM policy and wondered: Is it really necessary to grant access to this specific action? CloudTrail can help here, but there is something better: Record API calls with Client Side Monitoring.

https://cloudonaut.io/record-aws-api-calls-to-improve-iam-policies/

#aws

🔸iam-policies-cli

A CLI tool for building simple to complex IAM policies based on CloudFormation templates.

https://github.com/mhlabs/iam-policies-cli

#aws

🔸Awesome AWS S3 - Security, Tools and Intel

Collection of tools, techniques and useful links concerning security and exposed AWS S3 Buckets

https://github.com/mxm0z/awesome-sec-s3#awesome-aws-s3---security-tools-and-intel

#aws

🔸Security Architecture Review Of A Cloud Native Environment

Walkthrough of a cloud security assessment performed on an organisation which had recently moved their infrastructure from an on-prem to a cloud native solution (AWS).

https://notsosecure.com/security-architecture-review-of-a-cloud-native-environment/

#aws

🔸AWS Digital Forensics Automation at Goldman Sachs

Goldman Sachs has automated an event-driven cloud response solution that uses AWS native services to successfully collect disk and memory evidence from Amazon EC2 instances. The solution uses AWS security services Amazon GuardDuty and AWS Security Hub. It also leverages a variety of services such as AWS Lambda, AWS Step Functions, and AWS Systems Manager (SSM). This Tech Talk provides an overview of Goldman Sachs' environment and a deep dive on how they built automation for digital forensics using AWS native services.

https://youtu.be/CR4_a-TO_gw

#aws

🔸AWS IAM explained for Red and Blue teams

Article trying to shine some light on IAM, as well as some ways to enumerate it with different tools.

https://medium.com/bugbountywriteup/aws-iam-explained-for-red-and-blue-teams-2dda8b20fbf7

#aws

🔸Offensive Terraform Modules

Collection of (automated) offensive attack modules defined as Infrastructure as Code (IAC).

https://offensive-terraform.github.io/

#aws

Serverless Seurity

#aws #azure #gcp

🔷🔸Enter the Vault: Authentication Issues in HashiCorp Vault

Project Zero found two vulnerabilities in HashiCorp Vault and its integration with AWS and GCP, which can lead to an authentication bypass in configurations that use the aws and gcp auth methods. Both vulnerabilities (CVE-2020-16250/16251) were addressed by HashiCorp and are fixed in Vault versions 1.2.5, 1.3.8, 1.4.4 and 1.5.1 released in August.

https://googleprojectzero.blogspot.com/2020/10/enter-the-vault-auth-issues-hashicorp-vault.html

#aws #gcp

🔸A visual introduction to AWS Lambda permissions

Article explaining with visual examples the AWS Lambda permission model, focusing on cross-account access and the principle of least privilege.

https://dev.to/harprit/a-visual-introduction-to-aws-lambda-permissions-1k87

#aws

🔸Use AWS Lambda Extensions to Securely Retrieve Secrets From HashiCorp Vault

HashiCorp announced the public preview of a HashiCorp Vault AWS Lambda extension, utilizing the newly announced AWS Lambda Extensions API (also in public preview) to securely retrieve secrets from HashiCorp Vault.

https://www.hashicorp.com/blog/aws-lambda-extensions-for-hashicorp-vault

#aws

🔸Building the Next Evolution of Cloud Networks at Slack

An overview of the design decisions and tech choices made along the way for Slack’s brand-new network architecture redesign project.

https://slack.engineering/building-the-next-evolution-of-cloud-networks-at-slack/

#aws

🔸Public dataset of Cloudtrail logs from flaws.cloud

Scott Piper has released anonymized CloudTrail logs from flaws.cloud, his hands-on, free AWS security training challenges. The logs are roughly 240MB of largely attack data, covering over a 3.5 year span.

https://summitroute.com/blog/2020/10/09/public_dataset_of_cloudtrail_logs_from_flaws_cloud/

#aws