4 ms·

While VPN's shouldn't be the only device, it seems like that should be part of any competent security posture. E.g. Jenkins should only be accessible from known

While VPN's shouldn't be the only device, it seems like that should be part of any competent security posture. E.g. Jenkins should only be accessible from known VPN endpoint IP addresses. Administrative IAM's should be IP restricted as well: https://aws.amazon.com/premiumsupport/knowledge-center/iam-restrict-calls-ip-addresses/ https://aws.amazon.com/premiumsupport/knowledge-center/iam-r...

gcbirzan 4y ago
And the s3 buckets/dynamodb/whatever other data you store should be vpc restricted. Ours are like this by default, for exceptions (like aws services that run in some internal vpc that's not exposed) you can make an exception per role.