AWS Security - Best Practices (in light of a recent breach)

As of the date that I am creating this, the (actual) details have not been released regarding the 2019 Recent breach involving a WAF exploitation and S3 exfiltration.

A particular thread I had reviewed indicated that a 3rd-party WAF was exploited, which implies that it was likely to have been running on an EC2 instance.  This EC2 instance "metadata service" was then exploited by that WAF appliance software.

I think there are several potential opportunities to improve the security posture..

  • IAM
  • SCPs
  • Security Groups
  • S3 access policy


  • defense in depth
  • least privilege



One thing that was a concern to me,;preventing access to the "metadata service" (from a host with Internet access), I would like to explore the impact of the following:

iptables -A OUTPUT -m owner ! --uid-owner root -d 169.254.169.254 -j DROP

I was initially surprised to learn that VPC Flow Logs do not capture the traffic destined for the instance metadata endpoint (but then realized, that is not a VPC communication - makes sense).
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
Flow logs do not capture all IP traffic. The following types of traffic are not logged:
  • Traffic generated by instances when they contact the Amazon DNS server. If you use your own DNS server, then all traffic to that DNS server is logged.
  • Traffic generated by a Windows instance for Amazon Windows license activation.
  • Traffic to and from 169.254.169.254 for instance metadata.

References:

Comments

Post a Comment

Popular posts from this blog

Apple OSX Catalina and VMware vCenter Server Appliance.. ugh

OSX Catalina came with some rather annoying challenges: dropped support for 32-bit apps.  I don't play Steam games that much on my Mac now that I am stuck at home all the time.  So, not a big deal. implemented a bunch of "gatekeeper" security measures.  Now, typically I would say:  if you need to circumvent security ("Disable SELinux" - for example), you're probably doing it wrong.  But, the case of all the hand-holdy, lockdown stuff, it's pretty annoying.  Several things you cannot simply "accept the risk" and move on, you get constant reminders.  And it is interesting that whenever Microsoft does this sort of thing, it's widely discussed they are vilified.  Somehow, when Apple does this.. meh, just the cost of doing business. The challenges, themselves, are not the point of this post.  The point is you need to do some stuff if you expect to use Mac OSX Catalina to deploy VMware vSphere 6.7 U3 - vCenter Server Appliance. Download the ISO (...
Read more

HomeLab - Sophos XG SSL VPN and Comcast

Ugh... Comcast.  This sucked particularly much as this was my first attempt to configure a VPN back to my HomeLab and therefore was not sure what options I should have *known* would work.  Anywho... Sophos SSL VPN uses 8443 by default.  I spent a few hours trying to get through the config on the Sophos and my Linux client.  Nothing was working. For giggles I changed the Sophos to use 443, and then updated my client on my Linux workstation.  And suddenly it all works.  Fowk.  Tried 8443 again.  No love. I don't want to utilize port 443 as I intend to actually host some web apps for testing.  So, I have finalized on an "alternate" port which had to be configured on both the Sophos and the Linux client. I'l be doing a better write-up about this later.  I still need to figure out how to configure all this via the Gnome Network-Manager GUI.
Read more

Software RAID via kickstart (not cloud, sorry)

A bunch of the following specifics are out of scope, but I am including them anyhow # System bootloader configuration bootloader --location=mbr --boot-drive=sda --append=" crashkernel=auto hpsa.hpsa_allow_any=1 hpsa.hpsa_simple_mode=1 console=tty0 console=ttyS0,9600n8" # Partition clearing information #ignoredisk --only-use=sda zerombr clearpart --all --initlabel --drives=sda,sdb,sdc # Disk partitioning information part /boot/efi --fstype="efi" --fsoptions="umask=0077,shortname=winnt" --ondisk=sda --size=256 part /boot --fstype="xfs" --ondisk=sda --size=1024 part pv.01 --fstype="lvmpv" --ondisk=sda --size=51200 --grow volgroup vg_rhel7 --pesize=4096 pv.01 logvol /              --fstype="xfs"  --size=10240 --name=root     --vgname=vg_rhel7 logvol /home          --fstype="xfs"  --size=1024  --name=home     --vgname=vg_rhel7 logvol /tmp           --fstyp...
Read more