News for hackers. Stuff that matters.

A comment on What happens when you leak AWS credentials and how AWS minimizes the damage.

Re:What happens when you leak AWS credentials and how AWS mi... by pritambarhate on Thursday April 06, 2023 @08:55AM (#35467717)
I think it will be great if AWS allowed us to use the AWS keys to be used from certain IPs only. It will add additional layer of security which can help to prevent a lot of misuse. Just like AWS best practices of putting DB instances in a private VPC can prevent a lot of attack vectors, ability to use AWS Keys only from certain IPs or IP ranges, can also prevent from misuse, even if one accidentally leaks certain keys.
[ Parent | on HN ]
Re:What happens when you leak AWS credentials and how AWS mi... by circular_logic on Thursday April 06, 2023 @09:00AM (#35467767)
This looks to be possible via this guide https://repost.aws/knowledge-center/iam-restrict-calls-ip-ad...
[ Parent | on HN ]
Re:What happens when you leak AWS credentials and how AWS mi... by aeyes on Thursday April 06, 2023 @09:17AM (#35467943)
This example is for a role but for IAM users it works the same way.
[ Parent | on HN ]
Re:What happens when you leak AWS credentials and how AWS mi... by bpodgursky on Thursday April 06, 2023 @10:14AM (#35468567)
I don't think AWS wants to imply in any way that you need to be on a VPN to interact with AWS resources. It's not the direction they are going (Zero trust / RBA https://aws.amazon.com/security/zero-trust/).
[ Parent | on HN ]
Re:What happens when you leak AWS credentials and how AWS mi... by Godel_unicode on Thursday April 06, 2023 @01:14PM (#35471418)
Zero trust doesn’t mean no VPNs, it means not just VPNs. In other words you can put your control plane behind ACLs (and you should!) but you should still require strong auth from the private network.
[ Parent | on HN ]
Re:What happens when you leak AWS credentials and how AWS mi... by Hikikomori on Thursday April 06, 2023 @10:30AM (#35468758)
It's already possible, but on a iam action level.
[ Parent | on HN ]
Re:What happens when you leak AWS credentials and how AWS mi... by wmfiv on Thursday April 06, 2023 @10:48AM (#35469041)
Source IP is an IAM global condition so it's available for all requests.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...

[ Parent | on HN ]
Re:What happens when you leak AWS credentials and how AWS mi... by bpicolo on Thursday April 06, 2023 @02:39PM (#35472546)
Haven't tried it, but should be able to use service control policies to do this broadly:

https://docs.aws.amazon.com/organizations/latest/userguide/o...

[ Parent | on HN ]