AWS’s New Sign-Up Sandbox Limits Security Controls, Requiring an Upgrade for Full Protection
Summary
AWS’s new sign-up experience places users in a cost-limited sandbox with some security protections but blocks several security services and permits risky configurations. The article examines its controls and explains why users seeking a stronger security posture must升级.
Key points
- New sign-ups create three AWS accounts in an Organization, while users initially access only a sandboxed member account.
- The sandbox restricts access to services including GuardDuty, Security Hub, Inspector, Macie, Detective, and Access Analyzer.
- CloudTrail is not configured at the account or Organization level, though users can review up to 90 days of CloudTrail Event History.
- Users can create IAM access keys, public S3 buckets, and EC2 instances using IMDSv1, despite warnings or configuration steps.
- A $20 monthly budget and service restrictions limit spending and workload creation; these controls are removed or changed when the account is upgraded.
- The sign-up flow uses Builder ID email verification and Account Access rather than initially providing root-user access.
- AWS-created IAM roles can receive PowerUserAccess, so users may need to reduce permissions after creation.
Article Details
- Topic
- Analysis of the security configuration, restrictions, and account-access model in AWS's new sign-up sandbox experience.
Vendors
Products
Access Analyzereven allowed! The sandbox denies access to GuardDuty, SecurityHub, Detective, Inspector, Macie, and Access Analyzer (even the free features). AWS Config and CloudTrail are allowed though.Account AccessThis post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox.AWS Configto GuardDuty, SecurityHub, Detective, Inspector, Macie, and Access Analyzer (even the free features). AWS Config and CloudTrail are allowed though.AWS OrganizationsBuilder IDWhen you sign up with this new experience, you generate a Builder ID instead of a root email and password. This login flow sends a verification code to your email for every login, resulting in a form of two-factorCloudTrailaccount. From there, I was able to look at the artifacts of what had been done, and could review the CloudTrail Event History.Control TowerThe new experience creates an account in a restricted sandbox, but it has some interesting differences when compared to something like Control Tower.Detectiveof the AWS security services are not even allowed! The sandbox denies access to GuardDuty, SecurityHub, Detective, Inspector, Macie, and Access Analyzer (even the free features). AWS Config and CloudTrail are allowedEC2I could launch an EC2 with IMDSv1, although I did need to change the default from IMDSv2 only.GuardDutyControl Tower is many of the AWS security services are not even allowed! The sandbox denies access to GuardDuty, SecurityHub, Detective, Inspector, Macie, and Access Analyzer (even the free features). AWS Config andIAM Role ManagerIAM Role ManagerInspectorsecurity services are not even allowed! The sandbox denies access to GuardDuty, SecurityHub, Detective, Inspector, Macie, and Access Analyzer (even the free features). AWS Config and CloudTrail are allowed though.Macieservices are not even allowed! The sandbox denies access to GuardDuty, SecurityHub, Detective, Inspector, Macie, and Access Analyzer (even the free features). AWS Config and CloudTrail are allowed though.S3History is still there though, which is a way to see 90 days of events, but through limited interface. S3 Public Block Access is not enabled at the account level, but is default enabled at the bucket level whenSecurityHubis many of the AWS security services are not even allowed! The sandbox denies access to GuardDuty, SecurityHub, Detective, Inspector, Macie, and Access Analyzer (even the free features). AWS Config and CloudTrail