Last Week In AWS Podcast

Links: Travis CI continues to be a security nightmare . Implementing IAM Permission Boundaries with AWS SSO using Terraform A user reported a vulnerability to a company through Bugcrowd. The writeup is really worth reviewing. The RSA conference was apparently a super spreader event . Because nobody beats the Wiz, they've got a post up on the secret agents installed by cloud service providers . Par...

Want to give your ears a break and read this as an article? You’re looking for this link. https://www.lastweekinaws.com/blog/should-you-take-a-job-at-aws/ Want to watch the full dramatic reenactment of this podcast? Watch the YouTube Video here: https://youtu.be/BCiUulzr9f8 Never miss an episode Join the Last Week in AWS newsletter Subscribe wherever you get your podcasts Help the show Leave a rev...

AWS Morning Brief for the week of June 20, 2022 with Corey Quinn.

Links: Azure’s continuing security woes The Meeting Owl videoconference device apparently had significant security problems   Brandon Sherman writes about how Temporal structures its access control strategy with regard to AWS   This week's S3 Bucket Negligence Award goes to Mobike.   Cloud Functions or Cloud Run launched from any GCP organization can bypass Google Kubernetes Engine (GKE) Authorize...

Want to give your ears a break and read this as an article? You’re looking for this link: https://www.lastweekinaws.com/blog/reinvent-keynote-incident/ Want to watch the full dramatic reenactment of this podcast? Watch the YouTube Video here: https://youtu.be/NGvLMsf4Wg8 Never miss an episode Join the Last Week in AWS newsletter Subscribe wherever you get your podcasts Help the show Leave a review...

AWS Morning Brief for the week of June 13, 2022 with Corey Quinn.

Links: Nick Jones' review of the AWS Security Model I linked to previously . Microsoft Azure has seen 6 'nightmare' cloud security flaws over the past year .  Unsecured Elasticsearch Data Replaced with Ransom Note AWS Systems Manager announces support for port forwarding to remote hosts using Session Manager   When and where to use IAM permissions boundaries   Security vulnerability in AWS's Manag...

Want to give your ears a break and read this as an article? You’re looking for this link. https://www.lastweekinaws.com/blog/the-strange-too-familiar-tale-of-uncle-suitcase/ Want to watch the full dramatic reenactment of this podcast? Watch the YouTube Video here: https://youtu.be/x70EypnAH1Y Never miss an episode Join the Last Week in AWS newsletter Subscribe wherever you get your podcasts Help t...

AWS Morning Brief for the week of June 6, 2022, with Corey Quinn.

Links: Poisoned Python and PHP packages purloin passwords for AWS access No, your cloud environment doesn't need a sandbox Spring 2022 SOC reports are now available with 150 services in scope Canary Tokens

Want to give your ears a break and read this as an article? You’re looking for this link. https://www.lastweekinaws.com/blog/the-aurora-serverless-road-not-taken/ Never miss an episode Join the Last Week in AWS newsletter Subscribe wherever you get your podcasts Help the show Leave a review Share your feedback Subscribe wherever you get your podcasts What's Corey up to? Follow Corey on Twitter (@q...

AWS Morning Brief for the week of May 30, 2022 with Corey Quinn.

Links: Google Cloud Build deep dive Andrea Brancaleoni found an ELB header security issue An article on You Can't Opt Out of Citizen Development   DOJ Announces It Won’t Prosecute White Hat Security Researchers Choosing the right certificate revocation method in ACM Private CA a somewhat... controversial AWS Security Maturity Model   AWS API calls that return credentials on GitHub

Want to give your ears a break and read this as an article? You’re looking for this link. https://www.lastweekinaws.com/blog/an-aws-free-tier-bill-shock-your-next-steps Never miss an episode Join the Last Week in AWS newsletter Subscribe wherever you get your podcasts Help the show Leave a review Share your feedback Subscribe wherever you get your podcasts What's Corey up to? Follow Corey on Twitt...

AWS Morning Brief for the week of May 23, 2022 with Corey Quinn.

Links: "Hacking the Cloud" is a community-built encyclopedia   npm dependency confusion attack . Windows Event Logs F5 appliance (software or hardware) full remote code execution with privileged access Wiz has a blog post up about securing AWS Lambda function URLs Build a strong identity foundation that uses your existing on-premises Active Directory How to use new Amazon GuardDuty EKS Protection...

Want to give your ears a break and read this as an article? You’re looking for this link. https://www.lastweekinaws.com/blog/an-aws-free-tier-bill-shock-your-next-steps/ Never miss an episode Join the Last Week in AWS newsletter Subscribe wherever you get your podcasts Help the show Leave a review Share your feedback Subscribe wherever you get your podcasts What's Corey up to? Follow Corey on Twit...

AWS Morning Brief for the week of May 16, 2022 with Corey Quinn.

Links: S3 Bucket Negligence Award Mandoogle on how AWS's instance metadata service can be abused by attackers Heroku  apparently had its entire database breached last week Wiz Research discovered a new vulnerability in Azure’s PostgreSQL Flexible Server service. AWS deleted packages they'd pushed to public repositories A guide to Cloud Security Orienteering

Want to give your ears a break and read this as an article? You’re looking for this link. https://www.lastweekinaws.com/blog/aws-s-deprecation-policy-is-like-a-platypus Never miss an episode Join the Last Week in AWS newsletter Subscribe wherever you get your podcasts Help the show Leave a review Share your feedback Subscribe wherever you get your podcasts What's Corey up to? Follow Corey on Twitt...

AWS Morning Brief for the week of May 9, 2022 with Corey Quinn.

Links:   SELinux is unmanageable; just turn it off if it gets in your way AWS welcomes new Trans-Atlantic Data Privacy Framework How to control access to AWS resources based on AWS account, OU, or organization AWS has an article that explains what the confused deputy problem The CloudGoat pentest training tool now supports Lambda

Want to give your ears a break and read this as an article? You’re looking for this link. https://www.lastweekinaws.com/blog/how-to-win-in-cloud Never miss an episode Join the Last Week in AWS newsletter Subscribe wherever you get your podcasts Help the show Leave a review Share your feedback Subscribe wherever you get your podcasts What's Corey up to? Follow Corey on Twitter (@quinnypig) See our...

AWS Morning Brief for the week of May 2, 2022 with Corey Quinn.

Links: Summit Route's AWS SCP Best Practices   Reported Apache Log4j Hotpatch Issues cloudtrail-partioner