cloudXabide | to the Cloud

There is quite a bit of nuance in managing accounts in AWS.  One particular issue I see come up is with managing account lifecycles (i.e. if a person wants to have "temp" accounts to provide for people to "play" and learn).  This is simply not easily accomplished.  However, there are procedural ways to deal with this if folks need this type of functionality.  I have given it the following moniker: "account recycling" The idea is that you would have different account types: "core" accounts under the control of your master/payer account - and these do not get recycled. Long lived line of business accounts - hosting production, etc... long lived developer accounts - (still trying to work through how these would be managed) "burner" accounts - preset limits for usage, pre-determined length of time the account is available The idea of the burner account is that you would create a "pool" of accounts that could be provided ...

I put away my pitchforks for protesting Microsoft almost 2 decades ago.  At first I was in the Microsoft is the devil camp... then I started working on Solaris... and then AIX... and then Linux (SuSE) and finally Red Hat Enterprise Linux.  With each iteration along that timeline, I continued to care less and less about what was going on with Microsoft and Windows.  When Microsoft started to show up in the headlines regarding Linux compatibility, Red Hat collaboration, Open Source contributions, I was minimally apprehensive and was actually rather optimistic that times were changing and they saw the light. Today - I am about to install the Linux version of Visual Studio Code (relegating Atom IDE to be the failback). sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc sudo su -c 'echo -e "[code]\nname=Visual Studio Code\nbaseurl=https://packages.microsoft.com/yumrepos/vscode\nenabled=1\ngpgcheck=1\ngpgkey=https://packages.microsoft.com/keys/microsof...

It is unlikely that many folks will find themselves in this particular situation. I have several AWS master/payer accounts - and one of the accounts "owned" my domain (cloudxabide.com) and I wanted to manage and control that domain from a different master account. Account A - cloudxabide.com. Account B - example.com. myotherexample.com. Initiate the transfer of the domain by... (complete this later) Create Hosted Zone (cloudxabide.com) and retrieve the 4 NS entries. Then click on Registered Domains and the zone you wish to update. Under the Name servers section there should be a "Add or edit name servers" entry - click on that. Replace the existing server entries with the values you found above. Once you have completed this step, you will need to wait for an email indicating the update has occurred.  You may have to wait up to 2 days for the records to finishing traversing the Interwebs, as well. whois cloudxabide.com | grep ^Name dig +short NS clo...

As of the date that I am creating this, the (actual) details have not been released regarding the 2019 Recent breach involving a WAF exploitation and S3 exfiltration. A particular thread I had reviewed indicated that a 3rd-party WAF was exploited, which implies that it was likely to have been running on an EC2 instance.  This EC2 instance "metadata service" was then exploited by that WAF appliance software. I think there are several potential opportunities to improve the security posture.. IAM SCPs Security Groups S3 access policy defense in depth least privilege One thing that was a concern to me,;preventing access to the "metadata service" (from a host with Internet access), I would like to explore the impact of the following: iptables -A OUTPUT -m owner ! --uid-owner root -d 169.254.169.254 -j DROP I was initially surprised to learn that VPC Flow Logs do not capture the traffic destined for the instance metadata endpoint (but then realiz...