Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Support able to access any S3 object due to permission change

twitter.com

Post reply on HN
Print view View original

71–80 of 134 posts

Re: AWS Support able to access any S3 object due to permission change

#71

Post by robertlagrant »

shepardrtc wrote: post #61
trzmiel4 wrote: post #24

Earlier quoted context omitted.

> I know how dumb customers can be I find this insulting as a customer. Is AWS usually contemptuous of its customers? I don't think I've ever called my customer "dumb", and working as a consultant I've seen all kinds of interesting things. People make mistakes. They're always in a hurry. They may have a hard time understanding ambiguous, complex or incomplete documentation. The interface may be confusing and lead the…

> working as a consultant I've seen all kinds of interesting things. You shouldn't compare consulting vs tech support. Especially when your billing rate is noticeably higher.

And tech support have to deal with the really dumb, annoying questions.

(I'm not tech support; I'm one of the ones asking said questions of them.)

Re: AWS Support able to access any S3 object due to permission change

#72

Post by dmead »

harshaw wrote: post #67

I guess taking some risks as I am not really authorized to use social media, but at AWS there is a sauron like focus on not letting internal engineers view customer data. On my service we don't even have tools to do it and the security controls are very tight and getting tighter all the time. It's a big fucking deal, if not the biggest fucking deal, besides KTLO. Posting to get ahead of some of the comment here on se…

KTLO?

Re: AWS Support able to access any S3 object due to permission change

#73

Post by aaronmdjones »

dmead wrote: post #72
harshaw wrote: post #67

I guess taking some risks as I am not really authorized to use social media, but at AWS there is a sauron like focus on not letting internal engineers view customer data. On my service we don't even have tools to do it and the security controls are very tight and getting tighter all the time. It's a big fucking deal, if not the biggest fucking deal, besides KTLO. Posting to get ahead of some of the comment here on se…

KTLO?

Keeping the Lights On.

Re: AWS Support able to access any S3 object due to permission change

#74

Post by brodouevencode »

geek_at wrote: post #55
L0g4n wrote: post #45

Such concerns specifically led to my decision of only uploading sensitive data to S3 with client side encryption. Since the aws cli tool only supports server side encryption with keys stored on amazon servers (where the non-default managed keys cost like 1 USD per month), I decided to simply symmetrically encrypt the backup of my syncthing data volume with AES256 using gnupg and only then pushing it to the S3 bucket.

this should be the default user behaviour for any cloud storage. Don't put unencrypted (company) data on a cloud infrastructure you don't have full control over. Also reminds me of the (hyped?) "outrage" when a former facebook developer stated that they used to have a "default password" that allowed fb devs to log into every account and the media were like "omg they could have logged in and seen your photos". I mean.…

It should be the default behavior in places where it makes sense - customer PII data, financials, etc. I'm not going through the headache of implementing encryption for otherwise public images.

Maybe AWS should have another object storage product that's specific to sensitive material. I know that would flip Corey Quinn's lid because it would be yet another AWS product (h/t to him for actually have a valuable twitter post and not just snark) but I honestly don't care - I'd rather have extra level of confidence. For this there would be absolutely no data access.

Tangentially, I wonder if this role has been deployed to GovCloud?

Re: AWS Support able to access any S3 object due to permission change

#75

Post by jonahbenton »

harshaw wrote: post #67

I guess taking some risks as I am not really authorized to use social media, but at AWS there is a sauron like focus on not letting internal engineers view customer data. On my service we don't even have tools to do it and the security controls are very tight and getting tighter all the time. It's a big fucking deal, if not the biggest fucking deal, besides KTLO. Posting to get ahead of some of the comment here on se…

I thought this was true at the engineering level, but "authorized" cross customer data sharing- where there is some debate at what's customer data vs what's platform data- at the business level seems...rampant? Just curious for more perspective on posture.

Re: AWS Support able to access any S3 object due to permission change

#76

Post by oneplane »

krisoft wrote: post #65
geek_at wrote: post #55

Earlier quoted context omitted.

this should be the default user behaviour for any cloud storage. Don't put unencrypted (company) data on a cloud infrastructure you don't have full control over. Also reminds me of the (hyped?) "outrage" when a former facebook developer stated that they used to have a "default password" that allowed fb devs to log into every account and the media were like "omg they could have logged in and seen your photos". I mean.…

> yeah they're the developers they could always do that even without the password Not really. Obviously facebook the company can always access your data. Weather or not an individual developer can do the same, which developers can do it, how they can do it, and under what level of supervision this would be is a design choice. It is possible to design a system with very high level of security and ones with none too. A…

Sadly, "yeah, they are the developers" applies far more often than any other scenario.

Unless a business is heavily regulated and checked for compliance, the burden and friction introduced by developer access controls to the data of the software they write is anecdotally not seen as a positive investment in any company I've seen the internals of.

Re: AWS Support able to access any S3 object due to permission change

#77

Post by gbrayut »

openplatypus wrote: post #63
luckylion wrote: post #27

Earlier quoted context omitted.

> AWS doesn’t access customers’ data Amazon's product people also don't look at third party seller statistics to decide which products to sell themselves. Until they got caught doing just that. To assume that they don't look at data feels naive. A German super market chain with online ambitions has a rule that nothing touching their pipeline can be hosted on AWS. Want to sell them SaaS? You can't run your nodes on AW…

That's great. It is heart-warming to hear some businesses are taking this threat seriously. We built are service in similar vain. Nothing can reside under authority on non-EU entity, and nothing can be hosted on servers owned by non-EU entity. This effectively removed AWS, Azure, GCP and Alibaba. And still, we had plenty of choice. We specifically picked “boring” cloud provider. No thrills cloud vendor which has core…

Curious on your thoughts about the "Sovereign Cloud" features discussed at https://cloud.google.com/blog/products/identity-security/new...

Would having a 3rd party host the services in the EU meet your requirements? Or having data residency restrictions with strict key management, EU based support, and access transparency/approvals?

IMO Google is also taking this seriously, but I am genuinely curious if any off the above would meet your requirements.

Re: AWS Support able to access any S3 object due to permission change

#78

Post by zelon88 »

krisoft wrote: post #65
geek_at wrote: post #55

Earlier quoted context omitted.

this should be the default user behaviour for any cloud storage. Don't put unencrypted (company) data on a cloud infrastructure you don't have full control over. Also reminds me of the (hyped?) "outrage" when a former facebook developer stated that they used to have a "default password" that allowed fb devs to log into every account and the media were like "omg they could have logged in and seen your photos". I mean.…

> yeah they're the developers they could always do that even without the password Not really. Obviously facebook the company can always access your data. Weather or not an individual developer can do the same, which developers can do it, how they can do it, and under what level of supervision this would be is a design choice. It is possible to design a system with very high level of security and ones with none too. A…

Just assume every engineer has access to everything. From a client perspective that's how you have to treat it.

There are so many zero days in regular consumer software, just imagine how many are in closed source public facing Amazon services.

Now multiply that by 100 to get the number of zero days that probably exist in Amazon's closed source dev only back end environment.

Re: AWS Support able to access any S3 object due to permission change

#79

Post by WFHRenaissance »

harshaw wrote: post #67

I guess taking some risks as I am not really authorized to use social media, but at AWS there is a sauron like focus on not letting internal engineers view customer data. On my service we don't even have tools to do it and the security controls are very tight and getting tighter all the time. It's a big fucking deal, if not the biggest fucking deal, besides KTLO. Posting to get ahead of some of the comment here on se…

It was like this at Facebook as well.

Re: AWS Support able to access any S3 object due to permission change

#80

Post by dylan604 »

trzmiel4 wrote: post #24
twosugars wrote: post #21

When I worked in aws, this is primarily used to check for permissions of an object. I know how dumb customers can be, for the most part this is used to see why a customer cannot delete a bucket or object those sort of things. I don't remember having ability to see actual customers data only metadata is accessible. Edit: Based on what I know, I'm pretty sure support will not be able see any of the customers data.

> I know how dumb customers can be I find this insulting as a customer. Is AWS usually contemptuous of its customers? I don't think I've ever called my customer "dumb", and working as a consultant I've seen all kinds of interesting things. People make mistakes. They're always in a hurry. They may have a hard time understanding ambiguous, complex or incomplete documentation. The interface may be confusing and lead the…

>I find this insulting as a customer. Is AWS usually contemptuous of its customers?

Oh come off it. We've all seen the idiotic things that "users" can do. Someone complains something isn't working. Then you go through the steps to see what they have done, and you think "why would you ever do that?" We've all been there, and if you haven't been there then you just haven't had much interaction with "users".

"Take it easy, shall we?"

Post reply on HN