Earlier quoted context omitted.
What's the fourth S stand for?
Super Simple Storage Service ;)
Bingo!
Twilio: Someone broke into our AWS S3 silo, added 'non-malicious' code to JS SDK
161–162 of 162 posts
Re: Twilio: Someone broke into our AWS S3 silo, added 'non-malicious' code to JS SDK
#162Earlier quoted context omitted.
For such an important bucket, they should have a. adopted the resource into a Cloudformation stack & a1. Enabled drift detection. b. Use an AWS config rule to monitor (appropriate) s3 buckets for any public access.
1. Drift detection is a relatively new feature. 2. CloudFormation was so basic for so long that most AWS professionals don't use it. They use Terraform or a similar, non AWS product.
You're absolutely right, and I think most of us have a hard time a. learning about all of the new features and b. justifying going back and fixing up stuff to adopt the new features, but IMO for such a critical piece of infrastructure it should have been done and the engineers/architects should have been adding that sort of stuff to the backlog or requesting training or asking for resources, etc. For me, that sort of stuff is the only way I can get the green light to go back and refactor.