EC2's most dangerous feature

Re:EC2's most dangerous feature by gtsteve on Sunday October 09, 2016 @07:34AM (#12670804)

This is an interesting attack that I must confess I hadn't thought of, but surely any service that accepts an arbitrary URL has a list of IP ranges to avoid. However, to harden a role in the event of instance role credentials leaking, you could use an IAM Condition [0].

There is actually an example of this in the IAM documentation [1], although the source VPC parameter doesn't work for all services, and I can't see a list of services that support this parameter. This would ensure that the requests actually came from instances within your VPC.

[0] http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_po...

[1] http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucke...

[ Parent | on HN ]

Re:EC2's most dangerous feature by jamiesonbecker on Sunday October 09, 2016 @10:36AM (#12671361)

The point is not requests that originate elsewhere. The point is that this system is not protected in any way from any other process on your system.

[ Parent | on HN ]

Re:EC2's most dangerous feature by BraveNewCurency on Sunday October 09, 2016 @02:19PM (#12672507)

Er, the problem is not "people can hit an un-routable IP from outside your instance". The problem is that "if your instance allows an attacker to make a HTTP request, you might expose personal information". For example, web crawlers or other fetchers.

[ Parent | on HN ]