36 ms·

What's even worse is that IAM and Trusted Advisor will tell you what stupid things you have done. At no point does their article give guidance in turning that o

by gw99 4y ago

What's even worse is that IAM and Trusted Advisor will tell you what stupid things you have done. At no point does their article give guidance in turning that on. Because it compromises their sales pitch. Also if you push AWS keys into github (this does happen from time to time at the best organisation), github will nuke the rev. And even if you did it successfully there should be no damn keys which are usable because anything human issued should be via SSO and windowed or have MFA required set up. Everything else should be assume role based.

christophetd 4y ago
Hello! One of the authors here. We did release some (hopefully) actionable guidance alongside the study[1]. Trusted Advisor is a fair point, but note that most of its security checks only come with the Business or above AWS support plan. IAM Access Analyzer is a great service but it currently supports only 6 resource types[2]. We'll look into adding both, appreciate the feedback! [1]: https://securitylabs.datadoghq.com/articles/state-of-aws-cloud-security-followup/ https://securitylabs.datadoghq.com/articles/state-of-aws-clo... [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-resources.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access-anal...
- cloudy_future 4y ago
  "most of its security checks only come with the Business or above AWS support plan" Another fair point is Datadog also charges for its product.
  - christophetd 4y ago
    Sure. My point is that Trusted Advisor is also a commercial product, as opposed to IAM Access Analyzer which is free.
electroly 4y ago
FWIW all the interesting checks in Trusted Advisor (literally 100% of the good ones) are gated behind an AWS Support contract. We don't use Trusted Advisor because it's useless without a support contract, and as a small company we don't want to pay for a support contract that we don't otherwise need. I think it's not so great that AWS charges for these automated checks.

by gw99 4y ago

christophetd 4y ago

Hello! One of the authors here. We did release some (hopefully) actionable guidance alongside the study[1]. Trusted Advisor is a fair point, but note that most of its security checks only come with the Business or above AWS support plan. IAM Access Analyzer is a great service but it currently supports only 6 resource types[2]. We'll look into adding both, appreciate the feedback! [1]: https://securitylabs.datadoghq.com/articles/state-of-aws-cloud-security-followup/ https://securitylabs.datadoghq.com/articles/state-of-aws-clo... [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-resources.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access-anal...

cloudy_future 4y ago
"most of its security checks only come with the Business or above AWS support plan" Another fair point is Datadog also charges for its product.
- christophetd 4y ago
  Sure. My point is that Trusted Advisor is also a commercial product, as opposed to IAM Access Analyzer which is free.

electroly 4y ago

FWIW all the interesting checks in Trusted Advisor (literally 100% of the good ones) are gated behind an AWS Support contract. We don't use Trusted Advisor because it's useless without a support contract, and as a small company we don't want to pay for a support contract that we don't otherwise need. I think it's not so great that AWS charges for these automated checks.