Re:The State of AWS Security
by christophetd on Wednesday October 12, 2022 @08:17AM
(#33175831)
Hello! One of the authors here.
We did release some (hopefully) actionable guidance alongside the study[1].
Trusted Advisor is a fair point, but note that most of its security checks only come with the Business or above AWS support plan. IAM Access Analyzer is a great service but it currently supports only 6 resource types[2].
We'll look into adding both, appreciate the feedback!
[1]: https://securitylabs.datadoghq.com/articles/state-of-aws-clo...
[2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/access-anal...
Re:The State of AWS Security
by cloudy_future on Wednesday October 12, 2022 @10:35AM
(#33177592)
"most of its security checks only come with the Business or above AWS support plan"
Another fair point is Datadog also charges for its product.
Re:The State of AWS Security
by christophetd on Wednesday October 12, 2022 @10:39AM
(#33177665)
Sure. My point is that Trusted Advisor is also a commercial product, as opposed to IAM Access Analyzer which is free.
FWIW all the interesting checks in Trusted Advisor (literally 100% of the good ones) are gated behind an AWS Support contract. We don't use Trusted Advisor because it's useless without a support contract, and as a small company we don't want to pay for a support contract that we don't otherwise need. I think it's not so great that AWS charges for these automated checks.
Also if you push AWS keys into github (this does happen from time to time at the best organisation), github will nuke the rev. And even if you did it successfully there should be no damn keys which are usable because anything human issued should be via SSO and windowed or have MFA required set up. Everything else should be assume role based.