CloudSec Wine

🔷 Hacking Your Cloud: Tokens Edition 2.0

Techniques attackers might use to exploit cloud tokens and gain access to resources. Strong token management, limiting privileges, and token revocation policies help mitigate risks.

https://www.trustedsec.com/blog/hacking-your-cloud-tokens-edition-2-0

#azure

🔴 How to identify and reduce costs of your Google Cloud observability in Cloud Monitoring

A cost savings guide for Cloud Monitoring.

https://cloud.google.com/blog/products/management-tools/learn-to-understand-and-reduce-cloud-monitoring-costs

#gcp

🔶 Privilege escalation in AWS Elastic Kubernetes Service

An interesting privilege escalation scenario in Kubernetes (EKS) involving NodeRestriction.

https://blog.calif.io/p/privilege-escalation-in-eks

#aws

🔷 Building a secure Azure reference architecture with Terraform

A reference architecture including several components, such as a virtual network, a bastion host, a load balancer, and a cluster of virtual machines running a web application.

https://www.hashicorp.com/blog/building-a-secure-azure-reference-architecture-with-terraform

#azure

🔶 The Unholy Marriage of AWS IAM Roles and Instance Profiles

Post explaining IAM Roles and Instance Profiles, how to create and manage them, and attach them to EC2 instances to grant permissions to access AWS services while adhering to security best practices.

https://www.uptycs.com/blog/aws-iam-roles-instance-profiles

#aws

🔷 From listKeys to Glory: How We Achieved a Subscription Privilege Escalation and RCE by Abusing Azure Storage Account Keys

How the Orca Security team discovered a critical exploitation path, utilizing Microsoft Azure shared key authorization, and provide key mitigation steps.

https://orca.security/resources/blog/azure-shared-key-authorization-exploitation

#azure

🔶 Automate IAM credential reports for large AWS Organizations

How to manage credentials with many accounts, automate IAM credential reports, and consolidate the results.

https://aws.amazon.com/blogs/infrastructure-and-automation/automate-iam-credential-reports-for-large-aws-organizations

#aws

🔴 How to secure digital assets with multi-party computation and Confidential Space

To help customers use multi-party computation and Confidential Space, GCP described a reference architecture for implementing MPC-compliant blockchain signing.

https://cloud.google.com/blog/products/identity-security/how-to-secure-digital-assets-with-multi-party-computation-and-confidential-space

#gcp

🔶 Two Minor Cross-Tenant Vulnerabilities in AWS App Runner

These vulnerabilities leaked configuration information across tenant boundaries. While they are both minor issues, they further demonstrate that undocumented AWS APIs have lacked the scrutiny of AWS as well as the cloud security community.

https://frichetten.com/blog/minor-cross-tenant-vulns-app-runner

#aws

🔶 Containing Compromised EC2 Credentials Without (Hopefully) Breaking Things

There are multiple techniques for containing compromised instance credentials. The easy ones are the most likely to break things, but there are creative options to lock out attackers without breaking applications.

https://www.firemon.com/containing-compromised-ec2-credentials-without-hopefully-breaking-things

#aws

🔶 Exploring Amazon VPC Lattice

AWS has recently released VPC Lattice to General Availability. This post walks through creating a simple VPC Lattice service using CloudFormation, and takes a look at the service overall.

https://onecloudplease.com/blog/exploring-amazon-vpc-lattice

#aws

🔷 Introducing Microsoft Security Copilot: Empowering defenders at the speed of AI

Security Copilot combines an advanced large language model (LLM) with a security-specific model from Microsoft. This security-specific model in turn incorporates a set of security-specific skills and is informed by Microsoft's unique global threat intelligence. Security Copilot runs on Azure's infrastructure.

https://blogs.microsoft.com/blog/2023/03/28/introducing-microsoft-security-copilot-empowering-defenders-at-the-speed-of-ai

#azure

🔶 AWS KMS Threat Model

What are the threats in letting an AWS service manage the encryption of your data instead of creating a Customer Managed Key?

https://airwalkreply.com/aws-kms-threat-model

#aws

🔷 Riding the Azure Service Bus (Relay) into Power Platform

A deserialization issue on the Azure Service Bus (Relay) service that allowed remote code execution on Microsoft servers.

https://www.netspi.com/blog/technical/vulnerability-research/azure-service-bus-power-platform

#azure

🔶 Zero Trust Access to Private Webapps on AWS ECS with Cloudflare Tunnel

How to use Cloudflare Tunnel to securely access a Flask webapp running in a private subnet in ECS on Fargate, without exposing the app to the public internet.

https://blog.marcolancini.it/2023/blog-cloudflare-tunnel-zero-trust-ecs

#aws

🔷 Super FabriXss: From XSS to an RCE in Azure Service Fabric Explorer by Abusing an Event Tab Cluster Toggle

Post exploring the details of the Azure vulnerability, "Super FabriXss," the risks it poses, as well as recommendations on how to mitigate it.

https://orca.security/resources/blog/super-fabrixss-azure-vulnerability

#azure

🔶 The illustrated guide to S3 pre-signed URLs

Article discussing in great detail what pre-signed URLs are, how to use them, and some best practices to keep in mind.

https://fourtheorem.com/the-illustrated-guide-to-s3-pre-signed-urls

#aws

🔶 Implementing Magic Links with Amazon Cognito: A Step-by-Step Guide

A popular passwordless authentication method is magic links. Although this is not something that Cognito supports out of the box, it can be implemented using its Lambda hooks.

https://theburningmonk.com/2023/03/implementing-magic-links-with-amazon-cognito-a-step-by-step-guide

#aws

🔶 Mitigating SSRF in 2023

Article reviewing the different ways of triggering SSRF and discussing which mitigation techniques are most effective.

https://blog.includesecurity.com/2023/03/mitigating-ssrf-in-2023

#aws

🔷 Escalating Privileges with Azure Function Apps

Undocumented APIs used by the Azure Function Apps Portal menu allowed for arbitrary file reads on the Function App containers.

https://www.netspi.com/blog/technical/cloud-penetration-testing/azure-function-apps/

#azure