Full-blown AWS console compromise - this sounds similar to what happened to Code Spaces ( https://news.ycombinator.com/item?id=7909791 ) Is there a new vulnerability?
My concern exactly.
Bonsai Hosted ElasticSearch Is Down
11–20 of 20 posts
Re: Bonsai Hosted ElasticSearch Is Down
#12How were they 0wned? Lack of MFA, rogue API key, or something else? Are full-access accounts being handed out willy-nilly instead of IAM accounts? AWS Multi-Factor Authentication (MFA): http://aws.amazon.com/iam/details/mfa/ AWS Identity Access and Management (IAM): http://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPract... Managing your AWS API Keys: http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSG.…
At this point, MFA for master AWS accounts should be mandatory.
Re: Bonsai Hosted ElasticSearch Is Down
#13Not to focus on this when they are experiencing downtime, but Bonsai has been one of the least reliable service providers I've ever used.
qbox.io is another hosted Elasticsearch solution. I have never used them, but one of their developers is very knowledgeable and active on the mailing list.
Re: Bonsai Hosted ElasticSearch Is Down
#14AWS needs to improve usability of IAM so that it gets broader adoption. The learning curve is non-trivial.
So is creating policies.... They managed to make dealing with json worse than dealing with xml.
Re: Bonsai Hosted ElasticSearch Is Down
#15our site http://www.violetgrey.com went down because of this. Luckily we were able to reindex pretty fast before their backups kicked in. Any ideas on how to have fallbacks in such cases?
Re: Bonsai Hosted ElasticSearch Is Down
#16How were they 0wned? Lack of MFA, rogue API key, or something else? Are full-access accounts being handed out willy-nilly instead of IAM accounts? AWS Multi-Factor Authentication (MFA): http://aws.amazon.com/iam/details/mfa/ AWS Identity Access and Management (IAM): http://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPract... Managing your AWS API Keys: http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSG.…
At this point, MFA for master AWS accounts should be mandatory .
MFA for all console accounts is the only right answer. If machines require credentials to do specific task or perform API calls then roles should be used.
Re: Bonsai Hosted ElasticSearch Is Down
#17Earlier quoted context omitted.
At this point, MFA for master AWS accounts should be mandatory .
MFA for all console accounts is the only right answer. If machines require credentials to do specific task or perform API calls then roles should be used.
> If machines require credentials to do specific task or perform API calls then roles should be used.
Even then, if the data must be considered highly valuable/immutable, then versioning/delete protection should be enabled for the S3 bucket(s) in questions. This requires the MFA token to be in the API call for the delete to succeed.
Re: Bonsai Hosted ElasticSearch Is Down
#18AWS needs to improve usability of IAM so that it gets broader adoption. The learning curve is non-trivial.
What particular issues have you had with IAM? I find that the wizard is a good starting point for understanding the policies.
Re: Bonsai Hosted ElasticSearch Is Down
#19How were they 0wned? Lack of MFA, rogue API key, or something else? Are full-access accounts being handed out willy-nilly instead of IAM accounts? AWS Multi-Factor Authentication (MFA): http://aws.amazon.com/iam/details/mfa/ AWS Identity Access and Management (IAM): http://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPract... Managing your AWS API Keys: http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSG.…
Hey all, Bonsai cofounder here.
It was an old API access key that got leaked, not our account credentials. We're still investigating how and where the key got leaked, but bottom line, it should have been revoked ages ago.
2FA is great, but it doesn't cover API keys. Rotate your API keys!
Re: Bonsai Hosted ElasticSearch Is Down
#20Full-blown AWS console compromise - this sounds similar to what happened to Code Spaces ( https://news.ycombinator.com/item?id=7909791 ) Is there a new vulnerability?
It wasn't a management console compromise, it was an old API key that got leaked.