Last Week In AWS Podcast

Links:

• AWS Permission Boundaries for Dummies. 
• Improve the Availability of Existing Okta IAM Federation Setup Using Multi-Region SAML Endpoints 
• Use existing Logging and Security Account with AWS Control Tower
• IAM Access Analyzer makes it simpler to author and validate role trust policies 
• Tool of the week: cleanup-aws-access-keys

Want to give your ears a break and read this as an article? You’re looking for this link.

https://www.lastweekinaws.com/blog/aws-data-transfer-charges-ingress-actually-is-free/

Never miss an episode

• Join the Last Week in AWS newsletter
• Subscribe wherever you get your podcasts

Help the show

• Leave a review
• Share your feedback
• Subscribe wherever you get your podcasts

Buy our merch 

• https://store.lastweekinaws.com

What's Corey up to?

• Follow Corey on Twitter (@quinnypig)
• See our recent work at the Duckbill Group
• Apply to work with Corey and the Duckbill Group to help lower your AWS bill

Links:

• AWS Cloud Map Updates Service Level Agreement 
• Amazon DevOps Guru now allows customers control over the notifications they receive 
• Amazon S3 Object Lambda now supports using your own code to modify the results of S3 HEAD and LIST API requests
• Amazon SageMaker Clarify now can provide near real-time explanations for ML predictions 
• AWS Lambda Functions powered by AWS Graviton2 now available in 12 additional regions
• The five most visited Amazon DynamoDB blog posts of 2022 
• Prevent account takeover at login with the new Account Takeover Insights model in Amazon Fraud Detector 
• Bootstrapping multiple AWS accounts for AWS CDK using CloudFormation StackSets
• Designing hyperscale Amazon VPC networks 

Links:

• AWS RDS Aurora wish list 
• The Confusing Lifetimes of AWS IAM Identity Center Access Tokens
• AWS announces updated Support Plans Console with new IAM controls
• How to automatically build forensic kernel modules for Amazon Linux EC2 instances
• Tool of the week: aws-security-survival-kit 

Want to give your ears a break and read this as an article? You’re looking for this link.

https://www.lastweekinaws.com/blog/confidential-computing-is-for-the-tinfoil-hat-brigade

Want to watch the full dramatic reenactment of this podcast? Watch the YouTube Video here: https://youtu.be/z_jD64jGhhI

Never miss an episode

• Join the Last Week in AWS newsletter
• Subscribe wherever you get your podcasts

Help the show

• Leave a review
• Share your feedback
• Subscribe wherever you get your podcasts

Buy our merch 

• https://store.lastweekinaws.com

What's Corey up to?

• Follow Corey on Twitter (@quinnypig)
• See our recent work at the Duckbill Group
• Apply to work with Corey and the Duckbill Group to help lower your AWS bill

Links:

• Amazon S3 Replication Time Control for predictable replication time now available in the AWS China (Beijing) and AWS China (Ningxia) Regions 
• Amazon SageMaker Canvas supports mathematical functions and operators for richer data exploration 
• Snow Amazon Linux 2 (AL2) Amazon Machine Image (AMI) available on all Snow Family jobs 
• Announcing 1-Click templates and tutorials in AWS Budgets 
• AWS Certificate Manager Private Certificate Authority is now AWS Private Certificate Authority
• AWS Cloud Control API now supports AWS PrivateLink
• AWS Compute Optimizer now supports 37 new EC2 instance types and new memory metrics for Windows instances
• AWS Copilot, a CLI for the containerized apps, adds IAM permission boundaries and more 
• AWS Cost Categories now support retroactive rules application 
• Amazon File Cache – A High Performance Cache On AWS For Your On-Premises File Systems 
• Amazon WorkSpaces Introduces Ubuntu Desktops
• Migrate from Oracle RAC to AWS: Alternatives on AWS
• Set up enterprise-level cost allocation for ML environments and workloads using resource tagging in Amazon SageMaker
• Secure media delivery at the edge on Amazon Web Services 

Links:

• The Challenges of Assessing Kubernetes clusters for PCI Compliance. 
• Tailscale released a post titled What we learned (and can share) from passing our SOC 2 Type II audit that is absolutely worth your time and attention.
• Our friends at Wiz discovered a vulnerability in Oracle Cloud’s security where you could mount other customers' EBS volumes simply by asking the API to do so. 
• From the Mouth of AWS Horse: Announcing an update to IAM role trust policy behavior 
• In the world of tools, AWS has launched its rolesanywhere-credential-helper

Want to give your ears a break and read this as an article? You’re looking for this link.

Want to watch the full dramatic reenactment of this podcast? Watch the YouTube Video here: https://youtu.be/iOqSjqhD2lc

Never miss an episode

• Join the Last Week in AWS newsletter
• Subscribe wherever you get your podcasts

Help the show

• Leave a review
• Share your feedback
• Subscribe wherever you get your podcasts

Buy our merch 

• https://store.lastweekinaws.com

What's Corey up to?

• Follow Corey on Twitter (@quinnypig)
• See our recent work at the Duckbill Group
• Apply to work with Corey and the Duckbill Group to help lower your AWS bill

Links:

• If you're near Arlington Virgina, come on by Highline this evening at 7PM and let me buy you a drink.
• Are you confused by AWS's KMS service? Me too. This guide to KMS helped a lot--and you really don't want to be confused by security things.
• BHIM leaks the details of 7.26 million users and scores themselves an S3 Bucket Negligence Award in the process. Stop doing this!
• Securely Using External ID for Accessing AWS Accounts Owned by Others - AWS blesses us with a great rundown of how to think about external IDs for accessing AWS accounts. 
• Use AWS Network Firewall to filter outbound HTTPS traffic from applications hosted on Amazon EKS and collect hostnames provided by SNI- Don't let your sensitive environments connect all willy-nilly (or more formally, all William-Nilliam) to anything they want on the internet. 
• Last week I mentioned that you might want to enable TouchID to approve sudo requests on macOS. A couple of you pointed out that this setting gets wiped on OS updates, so having a script like this handy to reapply it will likely serve you well. 
• Cloudfox is a great collection of scripts stuffed into a framework and called a tool that empowers cloud penetration tests. Much like the industry, it biases heavily for AWS; take a look.