5 ms·
A superset of these best practices in the article would be CIS benchmarks. Collectively agreed on by industry leaders and provide extensive resources that span
by vladdoster 5y ago
A superset of these best practices in the article would be CIS benchmarks. Collectively agreed on by industry leaders and provide extensive resources that span the gamut of cloud, networking, and storage infrastructure.
CIS supported technologies: https://www.cisecurity.org/cis-benchmarks https://www.cisecurity.org/cis-benchmarks
CIS Audit AWS infra: https://github.com/toniblyx/prowler https://github.com/toniblyx/prowler
Better to be proactive than reactive :^)
- belter 5y agoIf you are on AWS you dont need bastion hosts anymore. Use Session Manager.
- acdha 5y agoI agree in general but there are a handful of edge cases which Google solved better with IAP: SSM can't forward ports to other hosts or any resource other than EC2. It's great for using SSH, SFTP, even tools like Ansible work fine, but if you need to get a port forward to something like RDS, a service in Fargate, etc. you'll need something else.
- jvolkman 5y agoWe still need bastions to connect to RDS. But we connect to the bastions using SSM.
- deleted 5y ago[deleted]