5 ms·

Are there AWS experts who can do some sort of quick audit or "sanity check" of an environment's configurations? AWS almost makes it too easy for someone who on

Are there AWS experts who can do some sort of quick audit or "sanity check" of an environment's configurations? AWS almost makes it too easy for someone who only sort of knows what they're doing (like me) to get things up and running.

alpha_squared 7y ago
I don't know that there's a "quick audit", there are too by vectors for any single professional to check. You'd be best served by using an auditing or monitoring solution. Even then, you're really just auditing _known_ vectors as it's likely impossible to cover all possible ones. I used to work on an auditing and monitoring platform, there really are too many vectors.
scarface74 7y ago
AWS locks everything down by default. As far as I know, there is no direct way through the GUI to make a bucket public, you have to know how to add the JSON policy and even then you get a very noticeable warning.
ec109685 7y ago
Ironically Capital One built Cloud Custodian, which does just this. But as you can see by the number of pull requests, it is an immense problem space: https://github.com/cloud-custodian/cloud-custodian/pulls?q=is%3Apr+is%3Aclosed https://github.com/cloud-custodian/cloud-custodian/pulls?q=i...
gnerix 7y ago
Check out the Trusted Advisor dashboard, GuardDuty is also a good thing to have running in your account
dopylitty 7y ago
There are many different automated systems for checking for misconfigurations in your AWS organization. Capital One even developed a very popular one (Cloud Custodian). Like most automated configuration checkers or monitoring systems they rely on being configured by experts because at their default settings they are mainly a source of annoying alerts that end up auto-filed to email folders you never look in because this is agile and we can rationalize the alert rules in the next iteration (we won't). They can also auto apply actions. Have fun debugging your Cloud Formation stack that failed because the automated checker system terminated the instance without notifying anyone because it was missing a required tag. As useless as these checkers are, the main problem is that there are so many different ways to gain access to resources that it's almost impossible to have a system that's useful to the business while also provably secure either manually or automatically. Don't forget even AWS themselves created a "managed" policy for some minor service which accidentally gave users root access in the account: https://medium.com/ymedialabs-innovation/an-aws-managed-policy-that-allowed-granting-root-admin-access-to-any-role-51b409ea7ff0 https://medium.com/ymedialabs-innovation/an-aws-managed-poli...
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
peterwwillis 7y ago
Basically, no. AWS is flexible enough to let you set it up in any complicated way you want, meaning it gives you plenty of rope to hang yourself with. It's arguably much easier to audit a random Linux box for security than an AWS account.
nullify88 7y ago
We run this tool every now and again which has helped me in the past. Not sure how it compares to Cloud Custodian though. https://github.com/toniblyx/prowler https://github.com/toniblyx/prowler

alpha_squared 7y ago

I don't know that there's a "quick audit", there are too by vectors for any single professional to check. You'd be best served by using an auditing or monitoring solution. Even then, you're really just auditing _known_ vectors as it's likely impossible to cover all possible ones. I used to work on an auditing and monitoring platform, there really are too many vectors.

scarface74 7y ago

AWS locks everything down by default. As far as I know, there is no direct way through the GUI to make a bucket public, you have to know how to add the JSON policy and even then you get a very noticeable warning.

ec109685 7y ago

Ironically Capital One built Cloud Custodian, which does just this. But as you can see by the number of pull requests, it is an immense problem space: https://github.com/cloud-custodian/cloud-custodian/pulls?q=is%3Apr+is%3Aclosed https://github.com/cloud-custodian/cloud-custodian/pulls?q=i...

gnerix 7y ago

Check out the Trusted Advisor dashboard, GuardDuty is also a good thing to have running in your account

dopylitty 7y ago

There are many different automated systems for checking for misconfigurations in your AWS organization. Capital One even developed a very popular one (Cloud Custodian). Like most automated configuration checkers or monitoring systems they rely on being configured by experts because at their default settings they are mainly a source of annoying alerts that end up auto-filed to email folders you never look in because this is agile and we can rationalize the alert rules in the next iteration (we won't). They can also auto apply actions. Have fun debugging your Cloud Formation stack that failed because the automated checker system terminated the instance without notifying anyone because it was missing a required tag. As useless as these checkers are, the main problem is that there are so many different ways to gain access to resources that it's almost impossible to have a system that's useful to the business while also provably secure either manually or automatically. Don't forget even AWS themselves created a "managed" policy for some minor service which accidentally gave users root access in the account: https://medium.com/ymedialabs-innovation/an-aws-managed-policy-that-allowed-granting-root-admin-access-to-any-role-51b409ea7ff0 https://medium.com/ymedialabs-innovation/an-aws-managed-poli...

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]

peterwwillis 7y ago

Basically, no. AWS is flexible enough to let you set it up in any complicated way you want, meaning it gives you plenty of rope to hang yourself with. It's arguably much easier to audit a random Linux box for security than an AWS account.

nullify88 7y ago

We run this tool every now and again which has helped me in the past. Not sure how it compares to Cloud Custodian though. https://github.com/toniblyx/prowler https://github.com/toniblyx/prowler