4 ms·
From the article its main focus vulnerability seems to be setups that don't use VPCs, which is default on AWS since long. It discusses human oversights like a s
by l33tman 5y ago
From the article its main focus vulnerability seems to be setups that don't use VPCs, which is default on AWS since long. It discusses human oversights like a server that needs to accept connections from other servers and where they then have opened a too large IP block. But this only makes sense if they were using internet IPs.. within a VPC this wouldn't matter.
With some even rudimentary knowledge of how IPV4 works this wouldn't be an issue on AWS, there are good defaults and tools to help avoiding this, no matter if you run Dockerized databases or bare metal dbs or use RDS.. you really have to explicitly open up your servers to end up open on the net..
- nickjj 5y agoI think in a lot of cases folks still make certain things public instead of using a VPC out of convenience. For example if a developer needs to access a resource within a VPC then this sky rockets complexity. You can't just connect to something running in a VPC from the outside world. You'd have to install and configure a VPN and it becomes a whole ceremony for both the person setting all of this up and the person connecting. Using a VPC/VPN and keeping your important things internal (like a database or staging environment, etc.) is a really good idea but unless you have someone who has a really solid understanding of this it's a whole lot easier to make something public, restrict a security group by IP and keep a whitelist of IPs up to date for developer access.
- wbkang 5y agoHow about just setting up a bastion host and then forwarding ports via SSH? It's much simpler than setting up a VPN.