News for hackers. Stuff that matters.

A comment on AWS RDS Vulnerability Leads to AWS Internal Service Credentials.

Re:AWS RDS Vulnerability Leads to AWS Internal Service Crede... by rmbyrro on Tuesday April 12, 2022 @05:18AM (#31000326)
It must be a fun job to spend the day poking software looking for holes.

Wish I could do this all day long...

Aside, the fact that it took almost 4 months to remediate all accounts is crazy. AWS and cloud in general was supposed to make it dumb easy to upgrade, patch and maintain infra software in production.

[ Parent | on HN ]
Re:AWS RDS Vulnerability Leads to AWS Internal Service Crede... by jdub on Tuesday April 12, 2022 @06:13AM (#31000653)
OK, now run the same remediation process except now you're maintaining all of your high availability database clusters yourself. :-)

RDS, simple as it may seem on the surface, is one of the things I'm most grateful for in AWS.

[ Parent | on HN ]
Re:AWS RDS Vulnerability Leads to AWS Internal Service Crede... by Nextgrid on Tuesday April 12, 2022 @07:32AM (#31001170)
The reason it took 4 months is because I don't think classic RDS can upgrade databases online. You'll either need to failover or have a few minutes of downtime. This is no different to on-prem.

Aurora might be a different situation, not sure.

[ Parent | on HN ]
Re:AWS RDS Vulnerability Leads to AWS Internal Service Crede... by jdub on Wednesday April 13, 2022 @10:26PM (#31022807)
Yes, it requires a little bit of work and scheduling. Very different to running the entire thing yourself, though!
[ Parent | on HN ]
Re:AWS RDS Vulnerability Leads to AWS Internal Service Crede... by pbalau on Tuesday April 12, 2022 @06:19AM (#31000700)
> Aside, the fact that it took almost 4 months to remediate all accounts is crazy. AWS and cloud in general was supposed to make it dumb easy to upgrade, patch and maintain infra software in production.

Easy doesn't mean fast.

[ Parent | on HN ]