3 ms·

AWS Users Are Leaving Security Holes

• deleted 15y ago
  [deleted]
• DenisM 15y ago
  tl/dr: people publish their AMIs and leave sensitive stuff in them.
  • deleted 15y ago
    [deleted]
  • asymptotic 15y ago
    RTFM. Technology advances, but the need to read the documentation governing its use will never go away. It's right here: Bundling Amazon EC2 instance store-backed Linux/UNIX AMIs » From an Existing AMI http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/creating-snapshot-s3-linux.html http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/cr... It is important to upload the key and certificate files into /mnt to prevent them from being bundled with the new AMI.
• redsymbol 15y ago
  The researchers created a scanner that is supposed to check for these vulnerabilities: https://code.google.com/p/amid/ https://code.google.com/p/amid/ Its readme contains some links that appear worth reading, if you're deploying AMIs securely. The researchers' own page on this story: http://trust.cased.de/AMID http://trust.cased.de/AMID