Last Week In AWS Podcast

Want to give your ears a break and read this as an article? You’re looking for this link.

https://www.lastweekinaws.com/blog/coreys-security-posture-2022

Want to watch the full dramatic reenactment of this podcast? Watch the YouTube Video here: https://youtu.be/dHDY69hIvvk

Never miss an episode

• Join the Last Week in AWS newsletter
• Subscribe wherever you get your podcasts

Help the show

• Leave a review
• Share your feedback
• Subscribe wherever you get your podcasts

What's Corey up to?

• Follow Corey on Twitter (@quinnypig)
• See our recent work at the Duckbill Group
• Apply to work with Corey and the Duckbill Group to help lower your AWS bill

Links:

• The most recently reported Azure vulnerability
• Amazon Photos exposes customers to risk
• I (re)discovered Scott Piper's work on Lesser Known Techniques for Attacking AWS Environments.
• PyPi python packages get caught sending stolen AWS keys to unsecured sites.
• TLS 1.2 to become the minimum TLS protocol level for all AWS API endpoints 
• GuardDuty has new findings 
• CloudFormation Guard had a new release.

Want to give your ears a break and read this as an article? You’re looking for this link:

https://www.lastweekinaws.com/blog/the-chatops-issue-no-ones-chatting-about

Want to watch the full dramatic reenactment of this podcast? Watch the YouTube Video here: https://youtu.be/eBKZ71OLjG8

Never miss an episode

• Join the Last Week in AWS newsletter
• Subscribe wherever you get your podcasts

Help the show

• Leave a review
• Share your feedback
• Subscribe wherever you get your podcasts

What's Corey up to?

• Follow Corey on Twitter (@quinnypig)
• See our recent work at the Duckbill Group
• Apply to work with Corey and the Duckbill Group to help lower your AWS bill

Links: 

• Azure has another security issue around its Synapse offering; this one was discovered by Tenable.
• Sysdig has a dive into the real threats to SSH on EC2.
• Tailscale has announced the ability to support Tailscale SSH.
• Chris Farris has a treatise on the The Philosphy of Prevention when it comes to cloud security.
• Google Cloud CISO Phil Venables asks whether security analogies are counterproductive. 
• A security issue of sorts was discovered around sts:GetSessionToken Role Chaining in AWS
• The person responsible for the giant Capital One hack that took advantage of a series of small AWS misconfigurations has been convicted.
• Rogue GitHub apps could have hijacked countless repos for a week or two earlier this year.
• Wickr for Government achieves FedRAMP Ready designation
• It takes an open source project like trackiam to collate IAM actions, AWS APIs, and managed policies from all over the place
• Passwordle lets you guess commonly used passwords.

Want to give your ears a break and read this as an article? You’re looking for this link.

https://www.lastweekinaws.com/blog/9-ways-aws-cdk-headdesk

Want to watch the full dramatic reenactment of this podcast? Watch the YouTube Video here: https://youtu.be/3Mf3_l6iEtA

Never miss an episode

• Join the Last Week in AWS newsletter
• Subscribe wherever you get your podcasts

Help the show

• Leave a review
• Share your feedback
• Subscribe wherever you get your podcasts

What's Corey up to?

• Follow Corey on Twitter (@quinnypig)
• See our recent work at the Duckbill Group
• Apply to work with Corey and the Duckbill Group to help lower your AWS bill

Links:

• Travis CI continues to be a security nightmare.
• Implementing IAM Permission Boundaries with AWS SSO using Terraform
• A user reported a vulnerability to a company through Bugcrowd. The writeup is really worth reviewing.
• The RSA conference was apparently a super spreader event.
• Because nobody beats the Wiz, they've got a post up on the secret agents installed by cloud service providers.
• Partitioning and Isolating Multi-Tenant SaaS Data with Amazon S3
• Service Notice – Upcoming changes required for AWS Config | AWS Cloud Operations & Migrations Blog
• Here's a list of best practices for writing Docker images that don't make you regret running them in production environments.

Want to give your ears a break and read this as an article? You’re looking for this link.

https://www.lastweekinaws.com/blog/should-you-take-a-job-at-aws/

Want to watch the full dramatic reenactment of this podcast? Watch the YouTube Video here: https://youtu.be/BCiUulzr9f8

Never miss an episode

• Join the Last Week in AWS newsletter
• Subscribe wherever you get your podcasts

Help the show

• Leave a review
• Share your feedback
• Subscribe wherever you get your podcasts

What's Corey up to?

• Follow Corey on Twitter (@quinnypig)
• See our recent work at the Duckbill Group
• Apply to work with Corey and the Duckbill Group to help lower your AWS bill