4 ms·

1. Isn't this a gap in the platform? I mean, shouldn't AWS automate this and alert (via AWS Config Rules/AWS Security Hub OR AWS Trusted Advisor) owners of thes

1. Isn't this a gap in the platform? I mean, shouldn't AWS automate this and alert (via AWS Config Rules/AWS Security Hub OR AWS Trusted Advisor) owners of these mis-configured resources? 2. Even better, should aws let customers proceed if they have mis-configurations?

throwaway984393 5y ago
Policing their customers' configurations would open them up for liability and embarrass them and their customers. But they do provide a ton of tools for customers to investigate their own security. AWS basically rents digital chainsaws. You hope they know how to use it, but you know a fair number probably don't.
tfigment 5y ago
#1 probably. #2 no. AWS is not responsible for how you setup your resources. They are very clear about that unless you use proserve or something. They are not your IT dept even for managed services.
jamesfinlayson 5y ago
AWS very much assumes you know what you're doing. Products like CloudConformity exist to let you know when you're probably misconfiguring something.
cobookman 5y ago
AWS has a product called Security Hub. There's a rule which will alert for any RDS instances open to the internet: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#fsbp-rds-2 https://docs.aws.amazon.com/securityhub/latest/userguide/sec...
jeroenhd 5y ago
That sounds like an excellent subscription plan, I'm sure they sell those services already. Of course Amazon assumes that you know what you're doing, so it won't include such scans by default. If you set up a container to be world accessible, you're probably intending to do so, otherwise you wouldn't expose it like that. If you're unsure, you can always pay extra to have Amazon verify such things for you, but they're not your IT infra manager and neither should they be.
coredog64 5y ago
SecurityHub will notify you if you launch the managed ES service outside a VPC. It’s still your responsibility to ensure that there is no ingress from the internet to the associated subnets. If you’re launching EC2 and installing ES on it, you’re probably going to have to create your own Config rules for auditing.

throwaway984393 5y ago

Policing their customers' configurations would open them up for liability and embarrass them and their customers. But they do provide a ton of tools for customers to investigate their own security. AWS basically rents digital chainsaws. You hope they know how to use it, but you know a fair number probably don't.

tfigment 5y ago

#1 probably. #2 no. AWS is not responsible for how you setup your resources. They are very clear about that unless you use proserve or something. They are not your IT dept even for managed services.

jamesfinlayson 5y ago

AWS very much assumes you know what you're doing. Products like CloudConformity exist to let you know when you're probably misconfiguring something.

cobookman 5y ago

AWS has a product called Security Hub. There's a rule which will alert for any RDS instances open to the internet: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#fsbp-rds-2 https://docs.aws.amazon.com/securityhub/latest/userguide/sec...

jeroenhd 5y ago

That sounds like an excellent subscription plan, I'm sure they sell those services already. Of course Amazon assumes that you know what you're doing, so it won't include such scans by default. If you set up a container to be world accessible, you're probably intending to do so, otherwise you wouldn't expose it like that. If you're unsure, you can always pay extra to have Amazon verify such things for you, but they're not your IT infra manager and neither should they be.

coredog64 5y ago

SecurityHub will notify you if you launch the managed ES service outside a VPC. It’s still your responsibility to ensure that there is no ingress from the internet to the associated subnets. If you’re launching EC2 and installing ES on it, you’re probably going to have to create your own Config rules for auditing.