Scott Piper's security consultancy blog, covering AWS security, free auditing tools, attack write-ups and a weekly infosec news recap.
HN commenters call Piper a leading AWS security expert and recommend his AWS security maturity roadmap and weekly recap.
Two basic principles will take you far with regards to AWS security:
1. Avoid long lived credentials (access key/secret key pairs) and IAM users whenever possible, and instead have everything assume roles for access to resources in the same as well as other accounts. Temporary credentials from STS are the way to go.
2. Turn on IMDSv2 by default for EC2 instances. v1 is susceptible to SSRF attacks so even if you’re attaching an instance profile to an instance and doing everything else right, you’ve got a problem if somebody finds a weakness in the app running on the instance.
Also heavily recommend checking out Scott Piper’s SCP Best Practices (https://summitroute.com/blog/2020/03/25/aws_scp_best_practices/) that still hold up even if being a few years old at this point.
Scott Piper's security maturity roadmap [1] is generally well regarded and outlines some recommendations that I would say are fairly "one-size fits most." AWS also recently released their "Foundational Security Best Practices" in Security Hub. [2]
[1] https://summitroute.com/downloads/aws_security_maturity_roadmap-Summit_Route.pdf
[2] https://aws.amazon.com/blogs/security/aws-foundational-security-best-practices-standard-now-available-security-hub/
It's a "hidden" (in that it's not documented very well or advertised much by AWS) feature of the AWS SDKs. I think it was likely added for debugging purposes originally, but security tools have started to hook into it as a more local and compete version of the kinds of logs you'd see in CloudTrail.
I've used it mostly for debugging and temporary monitoring of service calls.
https://summitroute.com/blog/2020/05/25/client_side_monitoring/
If you're doing backups for your business, I've written on how to properly encrypt backups[1] and how to use Google Compute Engine for backups[2]. I'm working on write-ups for AWS and Azure that should post within the new few weeks.
[1] https://summitroute.com/blog/2016/12/25/creating_disaster_recovery_backups/
[2] https://summitroute.com/blog/2016/12/25/using_google_for_backups/
Hey!
So to touch on a couple of points: Scott Piper is probably one of the most known AWS sec experts, check out his websites. https://summitroute.com/blog/
"Any approaches to formally proving that IAM roles and permissions are secure would be greatly appreciated! " Are you looking for a way to see that you have set up your policies correctly?
https://summitroute.com/downloads/aws_security_maturity_roadmap-Summit_Route.pdf
Scott Piper is the definitive AWS security expert, and this is a guide he publishes and maintains. I'd also suggest following him on Twitter, I learn a lot just from his idle tweets.
https://twitter.com/0xdabbad00