AWS Blog

Some of us are... https://blogs.aws.amazon.com/bigdata/post/TxGEL8IJ0CAXTK/Generating-Re…

Amazon promised bi-annual transparency reports here: https://blogs.aws.amazon.com/security/blog/tag/Transparency+report However only one report (covering a 6-month period) has was issued and posted in the initial blog post on June 2015. None have followed: http://d0.awsstatic.com/certifications/Information_Request_Report.pdf

AWS DDoS defense techniques summary https://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June2015.pdf AWS DDoS defense using rate based blacklisting https://blogs.aws.amazon.com/security/post/Tx1ZTM4DT0HRH0K/How-to-Conf…

PowerShell itself now has a packaging system and public repository for modules: http://www.powershellgallery.com/ PowerShell for Windows got this earlier in the year, and it's part of PowerShell Core. So with PS Core, you should be able to start a freshly installed copy of PS on whatever OS you are using, and add the AWS modules with this command: Install-Module AWSPowerShell.NetCore (Warning: this command does not work on the alpha release due to a bug - you need a workaround as described on the AWS blog: https://blogs.aws.amazon.com/net/post/TxTUNCCDVSG05F/Introducing-AWS-T… Nothing very impressive to anybody that has used any modern programming language, but now your shell has this too (if you use PS).

We are currently performing final validation on our new AWSPowerShell.NetCore module and hope to publish it to the PowerShell Gallery in the next couple of days. Blog post to the announcement: http://blogs.aws.amazon.com/net/post/TxTUNCCDVSG05F/Introducing-AWS-To…

It isn't gone, but you can at least recover from it now. https://blogs.aws.amazon.com/application-management/post/Tx11YT4MHFDZM…

This reminds me of an Instagram tool I used to use, ec2-ssh https://github.com/facebookarchive/ec2-ssh My biggest headache with most tools (like the article) is that they don't easily support cross-account roles. This leaves me using a combination of the awscli and jq. https://blogs.aws.amazon.com/security/post/Tx70F69I9G8TYG/How-to-enabl…

I created a small tool[1] to help continuously audit public github commits for secrets, like aws keys. It uses the AWS provided regexes[2] to do to. [1] - https://github.com/jfalken/github_commit_crawler [2] - http://blogs.aws.amazon.com/security/blog/tag/key+rotation

Here's a handy GREP to find AccessKey/SecretKey pairs: grep -RP '(?<![A-Z0-9])[A-Z0-9]{20}(?![A-Z0-9])' * grep -RP '(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])' * source: http://blogs.aws.amazon.com/security/post/Tx1XG3FX6VMU6O5/A-safer-way-…

> Is it, though? Yes, it is. Period. Full Stop. Don't ever check access keys into any repo, public, private or even self-hosted. AWS needs to do a better job of making you realize that access keys are like 100-year-old sticks of dynamite and should be handled with an equal amount of care considering they can cause a similar amount of damage. To their credit, they basically noted this when they changed the way access keys are handled in the command line tool[1]. Quoting: An important point is that the default location for the credentials file is a user directory. It's no longer part of a project file structure, such as an app.config file (.NET) or .properties file (Java). This can enhance security by allowing you to keep the credentials in a location that's accessible only to you, and it makes it less likely that you'll inadvertently upload credentials if you upload a project to a developer sharing site like GitHub. [1] http://blogs.aws.amazon.com/security/post/Tx3D6U6WSFGOK2H/A-New-and-St…