CloudSec Wine

🔶🔷🔴 Cloud Security Remediation Guides

CloudSploit's remediation guides are intended to be an open-source resource for improving cloud security. Many cloud IaaS providers like AWS, Azure, and Google Cloud have a shared responsibility model. They provide the physical and architectural security, along with tools to properly secure the services they offer, but it is up to the user to configure those settings properly.

https://github.com/aquasecurity/cloud-security-remediation-guides

#aws #azure #gcp

🔴 Best practices for using workload identity federation

This guide presents best practices for deciding when to use workload identity federation, and how to configure it in a way that helps you minimize risks.

https://cloud.google.com/iam/docs/best-practices-for-using-workload-identity-federation

#gcp

🔶 Snaring the Bad Folks

Blog post introducing Snare, Netflix's Detection, Enrichment, and Response platform for handling cloud security related findings. Snare is responsible for receiving millions of records a minute, analyzing, alerting, and responding to them.

https://netflixtechblog.com/snaring-the-bad-folks-66726a1f4c80

#aws

🔴 Using Google Cloud Service Account impersonation in your Terraform code

This blog details different ways to authenticate as a service account in Terraform code using short-lived credentials.

https://cloud.google.com/blog/topics/developers-practitioners/using-google-cloud-service-account-impersonation-your-terraform-code

#gcp

🔶 AWS SageMaker Jupyter Notebook Instance Takeover

An attacker can run any code on a victim's SageMaker JupyterLab Notebook Instance across accounts. This means that an attacker can access the Notebook Instance metadata endpoint and steal the access token for the attached role.

https://blog.lightspin.io/aws-sagemaker-notebook-takeover-vulnerability

#aws

🔴 Over-Privileged Service Accounts Create Escalation of Privileges and Lateral Movement in Google Cloud

There are standard best practices for service accounts but many GCP environments lag behind in implementing these best practices. This research shown how these violations in best practices can allow attackers to chain together attack steps to gain broader access to resources in a GCP environment.

https://www.netskope.com/blog/over-privileged-service-accounts-create-escalation-of-privileges-and-lateral-movement-in-google-cloud

#gcp

🔶🔷🔴 Cloud service provider security mistakes

Cloud historian Scott Piper has created a GitHub repo to catalogue security mistakes by cloud service providers (AWS, GCP, and Azure); that is, public mistakes on the cloud providers’ side of the shared responsibility model. Includes CVEs, SOC 2 Type 2 failures, security researchers compromising managed services, and more.

https://github.com/SummitRoute/csp_security_mistakes

#aws #azure #gcp

🔶 AWS Policy as Code Workshop

This workshop explores how to codify a set of rules that make up a policy, use a DevSecOps workflow to quickly address policy issues, and redeploy a policy compliant workload.

https://catalog.us-east-1.prod.workshops.aws/v2/workshops/9da471a0-266a-4d36-8596-e5934aeedd1f/en-US/

#aws

🔶 IAM roles for Kubernetes service accounts - deep dive

How IAM and Kubernetes work together allowing you to call AWS services from your pods with no hussle.

https://mjarosie.github.io/dev/2021/09/15/iam-roles-for-kubernetes-service-accounts-deep-dive.html

#aws

🔶 Data Perimeter Workshop

This workshop takes you through some of the best practices and available AWS services and features for creating a boundary around your resources in AWS.

https://data-perimeter.workshop.aws/

#aws

🔷 Azure Privilege Escalation via Azure API Permissions Abuse

How Azure API Permissions can be abused to escalate to Global Admin.

https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48

#azure

🔴 Illicit coin mining, ransomware, APTs target cloud users in first Google Cybersecurity Action Team Threat Horizons report

The first threat report from the Google Cybersecurity Action Team finds cloud users are often targeted by illicit coin mining, ransomware, and APTs.

https://cloud.google.com/blog/products/identity-security/coin-mining-ransomware-apts-target-cloud-gcat-report

#gcp

🔶 twistlock/splash

By Palo Alto Networks’s Yuval Avrahami: A pseudo shell re-invoking the Lambda for each command. For curious fellows who want to hack on AWS Lambda’s infrastructure.

https://github.com/twistlock/splash

#aws

🔶 Is AWS Recycling your Access Keys?

Temporary AWS API access key IDs, issued by AWS, are not unique and could repeat, which can impair AWS security tools detection capabilities.

https://www.hunters.ai/blog/hunters-research-is-aws-recycling-your-access-keys

#aws

🔶🔷🔴 AWS/Azure/GCP Permissions

Continuing with efforts on the permissions.cloud project, Ian Mckay has now have both Azure and GCP spaces available: azure.permissions.cloud and gcp.permissions.cloud.

https://aws.permissions.cloud/

#aws #azure #gcp

🔶 pre:Invent 2021

There were 234 AWS announcements in pre:Invent season. Chris Farris analysed 27 of them related to security and governance.

https://www.chrisfarris.com/post/preinvent2021/

#aws

🔷 Modernizing compliance: Introducing Risk and Compliance as Code

Google announced the launch of their Risk and Compliance as Code (RCaC) Solution. The RCaC solution stack enables compliance and security control automation through a combination of Google Cloud Products, Blueprints, Partner Integrations, workshops and services.

https://cloud.google.com/blog/products/identity-security/risk-and-compliance-as-code

#azure

🔶 Updates to IAM policy evaluation logic flow chart

AWS has finally updated the documentation around determining whether a request is allowed or denied within an account.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow

#aws

🔶 Effective IAM for AWS: A guide to realize IAM best practices

Learn how to secure AWS with usable IAM architecture, policies, and automation that scales security best practices efficiently to all developers.

https://www.effectiveiam.com/

#aws

🔶 Identity Federation for GitHub Actions on AWS

An useful step-by-step example on how to configure your GitHub Actions build jobs to securely and seamlessly use IAM Roles in AWS.

https://scalesec.com/blog/identity-federation-for-github-actions-on-aws/

#aws