Last Week In AWS Podcast

Last week in security news: AWS Firewall Manager supports referencing of Security Groups, Secure by Design: AWS to enhance MFA requirements in 2024, You Can't Control Your Data in the Cloud, and more!

Links:

• You Can't Control Your Data in the Cloud
• Chris Farris leaked 7 IAM keys in public (intentionally!
• Chris Farris also writes Security Hub gives me imposter syndrome
• Google is stuffing previously widely available security offerings into incredibly expensive paid-for tiers.
• AWS Firewall Manager supports referencing of Security Groups
• Secure by Design: AWS to enhance MFA requirements in 2024 
• Reported TorchServe Issue (CVE-2023-43654)
• Tip of the week: patch the embargoed libcurl high-severity issue that was made public after this recording but before publishing. 

Want to give your ears a break and read this as an article? You’re looking for this link.

https://www.lastweekinaws.com/blog/the-cloud-devil-you-know/

Never miss an episode

• Join the Last Week in AWS newsletter
• Subscribe wherever you get your podcasts

Help the show

• Leave a review
• Share your feedback
• Subscribe wherever you get your podcasts

Buy our merch 

• https://store.lastweekinaws.com

What's Corey up to?

• Follow Corey on Twitter (@quinnypig)
• See our recent work at the Duckbill Group
• Apply to work with Corey and the Duckbill Group to help lower your AWS bill

AWS Morning Brief for the week of October 10, 2023 with Corey Quinn.

Links:

• Sponsor re:Quinnvent
• Amazon DataZone is now generally available
• Amazon EC2 Hibernate now supports more operating systems 
• Lambda test events are now available in AWS SAM CLI 
• Simplify data transfer: Google BigQuery to Amazon S3 using Amazon AppFlow
• Coming November 2023: A new analysis experience on Amazon QuickSight
• Implement auto-increment with Amazon DynamoDB
• The Future of Personal Digital Records: Unlocking Security and Efficiency through Blockchain and Smart Contracts
• Slack elevates media pipeline with AWS Elemental MediaConvert and Amazon Transcribe
• Integrate multiple Microsoft Entra ID tenants with AWS IAM Identity Center
• Building high-throughput satellite data downlink architectures with AWS Ground Station WideBand DigIF and Amphinicy Blink SDR 
• Save the Date: Join AWS at the Reality Capture Network Conference, Oct 17 – Oct 19, 2023 

Last week in security news: When It Comes to Email Security, The Cloud You Pick Matters, Enable external pipeline deployments to AWS Cloud by using IAM Roles Anywhere, How AWS threat intelligence deters threat actors, and more!

Links:

• When It Comes to Email Security, The Cloud You Pick Matters
• Enable external pipeline deployments to AWS Cloud by using IAM Roles Anywhere
• Get the full benefits of IMDSv2 and disable IMDSv1 across your AWS infrastructure 
• How AWS threat intelligence deters threat actors
• Overhauling AWS Account Access with Terraform

AWS Morning Brief for the week of October 2, 2023, with Corey Quinn.

Links:

• Amazon Chime adds Waiting Room capability to further secure your meetings
• Amazon CloudFront announces security recommendations 
• Amazon DocumentDB (with MongoDB compatibility) supports in-place major version upgrade
• Amazon EC2 Serial Console now available in additional AWS Regions 
• AWS Application Composer now supports all 1000+ AWS CloudFormation resources
• DynamoDB global tables is now available in all AWS Regions 
• Announcing incremental export to S3 for Amazon DynamoDB
• Amazon Bedrock Is Now Generally Available – Build and Scale Generative AI Applications with Foundation Models 
• How to import existing resources into AWS CDK Stacks
• Introducing dual-stack and IPv6-only support for Amazon Route 53 Resolver Endpoints

Last week in security news: Accelerating development with AWS CDK plugin – CfnGuardValidator, This week's S3 Bucket Negligence Award is brought to you by PwC Nigeria, The volkswagen open source tool, and more!

Links:

• Last week I talked about AWS Management Console Access incorrectly. My thanks to Timothy Ingalls on the Last Week in AWS community Slack for flagging this for me. Gold star for you!
• This week's S3 Bucket Negligence Award is brought to you by PwC Nigeria.
• FusionAuth has a great dive into their annual SOC 2 vendor selection process.
• My beloved Retool has a post talking about how an MFA failure mode led to a small number of customers being exposed. 
• Accelerating development with AWS CDK plugin – CfnGuardValidator 
• How to implement cryptographic modules to secure private keys used with IAM Roles Anywhere 
• Tool of the week: The volkswagen open source tool detects when your tests are being run in a CI server, and makes them pass.

AWS Morning Brief for the week of September 25, 2023, with Corey Quinn.

Links:

• Today Corey is hosting a drink-up at 6 PM in Seattle at Outer Planet Brewing. If you're in town / free, come on by; let him buy you a beer.
• Later this week Corey will be hosting an AMA on 9/27 @ noon PDT over on YouTube. Bring questions!
• Accenture Extends Generative AI Capabilities to Accelerate Adoption and Value on AWS 
• New – Amazon EC2 M2 Pro Mac Instances Built on Apple Silicon M2 Pro Mac Mini Computers 
• How Chime Financial uses AWS to build a serverless stream analytics platform and defeat fraudsters 
• Centralizing management of AWS Lambda layers across multiple AWS Accounts
• Handle traffic spikes with Amazon DynamoDB provisioned capacity
• Streamline interstate Department of Motor Vehicles collaboration with Private Blockchain 
• How to host your Unreal Engine game for under $1 per player with Amazon GameLift 
• How United Airlines built a cost-efficient Optical Character Recognition active learning pipeline
• How VirtuSwap accelerates their pandas ... -based trading simulations with an Amazon SageMaker Studio custom container and AWS GPU instances
• Provision sandbox accounts with budget limits to reduce costs using AWS Control Tower
• Reducing the Scope of Impact with Cell-Based Architecture - Reducing the Scope of Impact with Cell-Based Architecture
• From Massage Therapist to Cloud Associate with AWS Academy 

Last week in security news: AWS IAM Identity Center session duration limit increases from 7 to 90 days, Access accounts with AWS Management Console PrivatAccess, A dive through using Amazon Athena in Incident Response, and more!

Links:

• This is an esoteric Firefox/Yubikey compatibility bug that I went blindly stumbling into and has been resolved.
• Chris Farris has a post up about deploying AWS Backup. 
• In preparation for re:Invent, the MGM had a massive cybersecurity issue
• Amazon EC2 now supports Block Public Access for Amazon Machine Images
• AWS IAM Identity Center session duration limit increases from 7 to 90 days
• AWS Identity and Access Management provides action last accessed information for more than 140 services 
• Access accounts with AWS Management Console Private Access 
• A dive through using Amazon Athena in Incident Response. This is important! 
• Corey will be hosting an AMA on 9/27 @ noon PDT over on Twitch. Bring questions!

AWS Morning Brief for the week of September 18, 2023 with Corey Quinn.
 
Links:

• Amazon SNS FIFO topics now support message delivery to Amazon SQS Standard queues
• Announcing API Gateway console refresh 
• Cost Anomaly Detection increases custom anomaly monitor limit to 500
• Custom notifications are now available for AWS Chatbot 
• How to Integrate Amazon CloudWatch Alarms with Atlassian Confluence Knowledge Articles 
• Building a secure webhook forwarder using an AWS Lambda extension and Tailscale
• Deploy Generative AI Models on Amazon EKS
• Troubleshoot networking issues during database migration with the AWS DMS diagnostic support AMI 
• Using AWS CloudFormation and AWS Cloud Development Kit to provision multicloud resources
• Combining content moderation services with graph databases & analytics to reduce community toxicity
• AWS Private Certificate Authority
• Retail Partner Conversations: How Rokt is impacting the future of retail 
• Simplify access to internal information using Retrieval Augmented Generation and LangChain Agents 
• How to view Azure costs using Amazon QuickSight 
• Centralized Dashboard for AWS Config and AWS Security Hub 
• Benefits of Domain Registration with Amazon Route 53 
• Use Bring your own IP addresses (BYOIP) and RFC 8805 for localization of Internet content
• Using NAT Gateways with multiple-Amazon VPCs at scale 
• Navigating change: From ophthalmologist to AWS Cloud expert

Last week in security news: Corey reported an over-scoped role to AWS security, The bad LastPass breach got even worse, How to enforce DNS name constraints in AWS Private CA, and more!

Links:

• I reported an over-scoped role to AWS security; the response from the SageMaker Canvas team was that it's working as intended.
• The bad LastPass breach that continues to get worse once again somehow got worse.
• Microsoft has published a rather thorough postmortem about how their signing key was leaked.
• A security newsletter features a scam that I reported via Twitter.
• Google has gone from paragon of security to apparently now sharing aspects of your browsing history with websites in Chrome,
• Establishing a data perimeter on AWS: Allow access to company data only from expected networks 
• How to enforce DNS name constraints in AWS Private CA 
• Tool of the week: ThreatMapper hunts for threats in your production platforms, and ranks these threats based on their risk-of-exploit.