3 ms·
IAM permissions can be filtered, for example: allow these actions, but only on a given resource. You can use ARNs (Amazon's globally unique identifier for a re
by tobz 12y ago
IAM permissions can be filtered, for example: allow these actions, but only on a given resource. You can use ARNs (Amazon's globally unique identifier for a resource in any one of their services, but structured to allow wildcards) to limit the scope.
It's an interesting attack angle, but since it's based on tagged instances in their account, you'd have to launch a box in their account. If those credentials you have to launch boxes don't include credentials to make changes to security groups, VPC settings, etc... maybe you can't even get those logs and passwords off the host except for copy/pasting. There's a bunch of other hinderances I could think of (internal SSL usage where client certificates are verified, but said certificates aren't part of any of their base AMIs so your host never gets actual traffic handed to it, etc)
- kgilpin 12y agoPeople lose and misplace AWS credentials all the time. To wit: http://www.techspot.com/news/56127-10000-aws-secret-access-keys-carelessly-left-in-code-uploaded-to-github.html http://www.techspot.com/news/56127-10000-aws-secret-access-k... So getting somebody's AWS credential is a lot easier than it sounds. The obstacles you mentioned are generally granted to any IAM User which has ec2 RunInstances privilege: * Can associate an instance with a security group * Can put an instance in a VPC * Can reach the internet from an instance The security group and VPC settings don't need to be modified, the box just needs to be placed appropriately. EC2 Security Groups in a VPC can restrict outbound traffic, but EC2 "classic" Security Groups only restrict inbound traffic. To me this seems like a lot of holes to have to close in order to gain the convenience of using tags for DNS.