News for hackers. Stuff that matters.

A comment on Twilio: Someone broke into our AWS S3 silo, added 'non-malicious' code to JS SDK. Parent comment

Re:Twilio: Someone broke into our AWS S3 silo, added 'non-ma... by throwlogon on Wednesday July 22, 2020 @11:00AM (#23917748)
What you described sounds like a pain.
[ Parent | on HN ]
Re:Twilio: Someone broke into our AWS S3 silo, added 'non-ma... by ed25519FUUU on Wednesday July 22, 2020 @12:34PM (#23918769)
What’s the pain? You literally don’t do anything to the bucket policy. It’s intentionally blank.

You already have a role in AWS that you use. Go into the console and say “this role can do S3 to this bucket” and you’re done.

[ Parent | on HN ]