AWS Security Primer • Hacker News Board

Re: AWS Security Primer

#41

Post by falcolas » Mon, Jun 26, 2017, 1:59 PM UTC

skMed wrote: post #26

falcolas wrote: post #22

Such a shallow dive: there really needs to be a lot more ink spilled on this topic in great depth. I've worked extensively with AWS over the last 4 years, and I can barely wrap my head around the scope of managing security in AWS. We have an entire department dedicated to security in our company, and none of them are remotely close to being experts in AWS security either. I'm starting to get curious if there even is…

> Instances get role data from the metadata service, but containers can't access that metadata and should access the local ECS agent instead (which has its own API). Just a quick aside, but is this can't or shouldn't ? I'm 100% positive you can use something like instance profile credentials from within a container (which loads credentials from the instance metadata service). I think I agree that there's definitely a…

Technically, shouldn't. But in AWS' documentation for container roles, they have a note that explicitly suggests implementing a iptables rule (and even provides the iptables command) to prevent access to the instance's metadata.

http://docs.aws.amazon.com/AmazonECS/latest/developerguide/t...

That said, this is another of those "more ink should be spilled" moments, since preventing access to the instance metadata is something that you SHOULD do from a security point of view.

Re: AWS Security Primer

#42

Post by samstave » Tue, Jun 27, 2017, 7:02 AM UTC

plange wrote: post #35

a13xb wrote: post #9

Earlier quoted context omitted.

> Not trying to be negative, I'm a fan of how much power AWS gives you. I am. I find AWS API incredibly baroque and has a lot of historic baggage. I suspect a lot of this complexity is a result of an accumulation of features made by multiple people in multiple teams over the years and inertia of customers relying on it, so there is (understandably) no will to change it.

Classic mistake. Except it's not really a mistake, but a conscious decision by whoever was in charge at the time (with the main focus probably being growing the company and not hurting current customers). How do we fix that though? Standards seem like the only solution but they either don't move fast enough or the early birds (in this case amazon, but another prime example is microsoft) become so entrenched they set…

I'd say that the best way to "fix" it - is to have new iterations/versions of an entire region that comes online with an updated stance on all aspects of environment management: deployment/security/auth etc..

Let new infra come up in the new region with auth-gateways to allow the new to talk to the old and vs versa...

maybe you put an S3 mirror of data from new-bucket-type to an old-bucket-type for RO data access from within the old region for data created in the new...

old users can make functional requests of the new api - but cannot manipulate anything directly...

Or some such model -- but role out wholly new regions and sunset old over time. (A new region can be us-east-3 next to us-east-2 and can sit in the same physical location to allow for in-house data transit on AWS' part, etc.)

Re: AWS Security Primer

#43

Post by skMed » Fri, Jun 30, 2017, 1:52 AM UTC

falcolas wrote: post #41

skMed wrote: post #26

Earlier quoted context omitted.

> Instances get role data from the metadata service, but containers can't access that metadata and should access the local ECS agent instead (which has its own API). Just a quick aside, but is this can't or shouldn't ? I'm 100% positive you can use something like instance profile credentials from within a container (which loads credentials from the instance metadata service). I think I agree that there's definitely a…

Technically, shouldn't. But in AWS' documentation for container roles, they have a note that explicitly suggests implementing a iptables rule (and even provides the iptables command) to prevent access to the instance's metadata. http://docs.aws.amazon.com/AmazonECS/latest/developerguide/t... That said, this is another of those "more ink should be spilled" moments, since preventing access to the instance metadata is s…

I don't recall Task Roles being a thing when I started using EC2 Container Service. For container security and isolation, that makes a whole lot of sense.