News for hackers. Stuff that matters.

A comment on Have lots of AWS accounts. Parent comment

Re:Have lots of AWS accounts by scarface74 on Monday October 03, 2022 @06:27PM (#33074550)
Besides, every time you try to create a “least privileged role” to run infrastructure as code, that role has so many privileges it’s easy for mistakes to cause mistakes in your production “environment” that you meant to only affect your dev “environment”.

And I know I’m probably preaching to the choir. But one of the misconceptions I have to constantly fight is “we run our Lambdas in a VPC for security reasons”. (Lambdas are never “run in” a customer VPC)

[ Parent | on HN ]
Re:Have lots of AWS accounts by icedchai on Monday October 03, 2022 @10:27PM (#33076134)
Yes, I tried arguing with someone that it was actually more secure to run your Lambda without associating it with a VPC. If it doesn't need access to the VPC resources, it shouldn't be "run in" one. What can be more secure than having absolutely no access?
[ Parent | on HN ]
Re:Have lots of AWS accounts by coredog64 on Wednesday October 05, 2022 @12:11AM (#33091138)
cfn_nag has this as a default security rule. So there’s one place to lay blame.
[ Parent | on HN ]