3 ms·
If you don't use vpc endpoints, usually you end up having to open network traffic to all of a particular aws service, not just yours. This means as an attacker
by spydum 4y ago
If you don't use vpc endpoints, usually you end up having to open network traffic to all of a particular aws service, not just yours.
This means as an attacker, I can also go spin up (s3/lambda/etc) and if your app was vulnerable in some way, I could exfil data to those aws services (or leverage them in RFI/CSRF/other attacks) in a way that shouldn't be possible.
- sigstoat 4y ago> you end up having to open network traffic to all of a particular aws service, not just yours > I could exfil data to those aws services I don't think any of the VPC endpoints have any restrictions on them; that is, once I've made an S3 endpoint in my VPC, it can be used to access any bucket. So... it seems like it could be used just as easily to exfiltrate data?
- cldellow 4y agoI haven't done it, but the docs seem to imply that some VPC endpoints, including S3, can support the usual policy documents to describe which actions/principals/resources are permitted: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html#edit-vpc-endpoint-policy-s3 https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...
- different_sort 4y agoThat is indeed the case.
- Galanwe 4y ago> once I've made an S3 endpoint in my VPC, it can be used to access any bucket. So... it seems like it could be used just as easily to exfiltrate data? On the contrary, and that is one of the strong points of using VPC endpoints. You can whitelister the buckets that are accessible through the endpoints, which means it is in fact the only way to prevent data exfiltration.