AWS Support able to access any S3 object due to permission change

Post by orf » Thu, Dec 23, 2021, 6:55 PM UTC

alpha_squared wrote: post #94

harshaw wrote: post #67

I guess taking some risks as I am not really authorized to use social media, but at AWS there is a sauron like focus on not letting internal engineers view customer data. On my service we don't even have tools to do it and the security controls are very tight and getting tighter all the time. It's a big fucking deal, if not the biggest fucking deal, besides KTLO. Posting to get ahead of some of the comment here on se…

While I recognize that's the ideal goal, and most appropriate, I think there may be gaps in practice. My team just discovered yesterday that a Kinesis Firehose Stream can still deliver to an S3 bucket that lacks a bucket policy and whose ACLs disable any access to it at all. That diminished my confidence a little bit that all teams are perfectly in compliance of the overall goal.

Post by tempnow987 » Thu, Dec 23, 2021, 7:39 PM UTC

alpha_squared wrote: post #94

harshaw wrote: post #67

I guess taking some risks as I am not really authorized to use social media, but at AWS there is a sauron like focus on not letting internal engineers view customer data. On my service we don't even have tools to do it and the security controls are very tight and getting tighter all the time. It's a big fucking deal, if not the biggest fucking deal, besides KTLO. Posting to get ahead of some of the comment here on se…

While I recognize that's the ideal goal, and most appropriate, I think there may be gaps in practice. My team just discovered yesterday that a Kinesis Firehose Stream can still deliver to an S3 bucket that lacks a bucket policy and whose ACLs disable any access to it at all. That diminished my confidence a little bit that all teams are perfectly in compliance of the overall goal.

Post by dastbe » Thu, Dec 23, 2021, 7:46 PM UTC

dylan604 wrote: post #80

trzmiel4 wrote: post #24

Earlier quoted context omitted.

> I know how dumb customers can be I find this insulting as a customer. Is AWS usually contemptuous of its customers? I don't think I've ever called my customer "dumb", and working as a consultant I've seen all kinds of interesting things. People make mistakes. They're always in a hurry. They may have a hard time understanding ambiguous, complex or incomplete documentation. The interface may be confusing and lead the…

>I find this insulting as a customer. Is AWS usually contemptuous of its customers? Oh come off it. We've all seen the idiotic things that "users" can do. Someone complains something isn't working. Then you go through the steps to see what they have done, and you think "why would you ever do that?" We've all been there, and if you haven't been there then you just haven't had much interaction with "users". "Take it ea…

Post by WFHRenaissance » Thu, Dec 23, 2021, 8:02 PM UTC

ummonk wrote: post #109

benlivengood wrote: post #103

Earlier quoted context omitted.

When I was at Facebook (2018-2020) there were in fact few permission barriers (click through the screen warning you to follow the rules, and that's at the UI level not to mention pulling stuff directly from Tao through the old PHP interfaces still laying around, or just building a user context from scratch), but plenty of auditing and automated detection.

I always did wonder how good the detection systems would be at catching people who access private data directly from Tao.

Post by go_blue_13 » Thu, Dec 23, 2021, 8:14 PM UTC

dmead wrote: post #72

harshaw wrote: post #67

I guess taking some risks as I am not really authorized to use social media, but at AWS there is a sauron like focus on not letting internal engineers view customer data. On my service we don't even have tools to do it and the security controls are very tight and getting tighter all the time. It's a big fucking deal, if not the biggest fucking deal, besides KTLO. Posting to get ahead of some of the comment here on se…

KTLO?