3 ms·

Grokking all of that is a massive undertaking, but it really NEEDS to be done by anybody deploying critical systems on AWS. I wish they would go so far as to re

Grokking all of that is a massive undertaking, but it really NEEDS to be done by anybody deploying critical systems on AWS. I wish they would go so far as to require some confirmation that the security docs were reviewed before being able to deploy to a particular service. At least in cases where PII is involved, it’s not optional in many jurisdictions to ignore them. Sure that UX could hurt adoption, but wouldn’t it ultimately boost retention? Success with a cloud IT org means nothing breaks and nothing leaks. Part of helping customers succeed is helping them not to fail to the point of catastrophic business risk. How many billions of private records have been leaked from S3 or ElasticSearch because of simple, detectable, preventable misconfiguration. AWS provides a number of security and compliance services today- for a price. They would do well to suggest sane defaults like they do with a default VPC.

vegardx 7y ago
I think you're confusing what the default VPC actually is. Most people would consider it anti-pattern. Back in the days the concept of a VPC didn't exist in AWS, so when it was introduced they also introduced the concept of a default VPC for new accounts. All new resources was created into by default in order to make it easier for people to keep working as they were used to. It only has a single subnet for each availability zone, which is connected to an Internet Gateway, effectively granting all resources with a public address assigned to it Internet access. That combined with the default security group was a recipe for unintended consequences. One thing I'd recommend is reading up on the Well-Architected Framework[0]. It approaches all the essentials in AWS and will likely save people from reinventing the wheel badly. There are aspects of the Well-Architected Framework that I don't follow, but those aspects become very clear when you understand what they're trying to make you do with it. [0] https://aws.amazon.com/architecture/well-architected/ https://aws.amazon.com/architecture/well-architected/
tixocloud 7y ago
This is where many folks don’t understand enterprise. The tech has gotta work but it shouldn’t impact the business in a negative way either. This is why out of the box, no vendors are perfect for us in the banking world because they just don’t get it yet and hence, kicks off a huge wave of customisations just to get it up to an enterprise security standard.
- Terretta 7y ago
  We should talk... email in profile.
zxcvbn4038 7y ago
One of my favorite tools to help with this is https://github.com/toniblyx/prowler https://github.com/toniblyx/prowler

vegardx 7y ago

I think you're confusing what the default VPC actually is. Most people would consider it anti-pattern. Back in the days the concept of a VPC didn't exist in AWS, so when it was introduced they also introduced the concept of a default VPC for new accounts. All new resources was created into by default in order to make it easier for people to keep working as they were used to. It only has a single subnet for each availability zone, which is connected to an Internet Gateway, effectively granting all resources with a public address assigned to it Internet access. That combined with the default security group was a recipe for unintended consequences. One thing I'd recommend is reading up on the Well-Architected Framework[0]. It approaches all the essentials in AWS and will likely save people from reinventing the wheel badly. There are aspects of the Well-Architected Framework that I don't follow, but those aspects become very clear when you understand what they're trying to make you do with it. [0] https://aws.amazon.com/architecture/well-architected/ https://aws.amazon.com/architecture/well-architected/

tixocloud 7y ago

This is where many folks don’t understand enterprise. The tech has gotta work but it shouldn’t impact the business in a negative way either. This is why out of the box, no vendors are perfect for us in the banking world because they just don’t get it yet and hence, kicks off a huge wave of customisations just to get it up to an enterprise security standard.

Terretta 7y ago
We should talk... email in profile.

zxcvbn4038 7y ago

One of my favorite tools to help with this is https://github.com/toniblyx/prowler https://github.com/toniblyx/prowler