cyber.hendryadrian.com
Security News · wiz.io

AWS re:Invent Adds Credential Visibility, Identity Federation and New Security Controls

· Original article ↗

Summary

The article reviews AWS announcements including browser-based CLI login, outbound identity federation with AWS principals, IAM policy generation, temporary delegation, organization-level S3 Block Public Access, and a TLS proxy.

Key points

  • The new aws login command uses a browser session to obtain credentials for CLI and other applications.
  • AWS SDK user-agent information can help identify in CloudTrail how an application's credentials were acquired.
  • IAM Outbound Identity Federation lets AWS principals authenticate to non-AWS services using JWTs that include AWS organization, OU path, and principal-tag information.
  • IAM Policy Autopilot generates application IAM policies using deterministic analysis, according to the article.
  • AWS added organization-level S3 Block Public Access and a TLS proxy for customers performing TLS inspection.
  • IAM temporary delegation is currently limited to customer onboarding for ISV Accelerate Partners; the author sees it as a possible foundation for just-in-time privileged access.

Article Details

Event Type
AWS security and cloud-management feature announcements
Impact
AWS announced new and updated capabilities for authentication, identity federation, credential visibility in CloudTrail, account transfers between Organizations, IAM policy generation, temporary delegation, organization-level S3 Block Public Access, and TLS inspection. The announcements describe potential improvements to access management, monitoring, and cloud security configuration; the article reports no security incident or realized harm.

Vendors

Amazon Web ServicesAWS’s largest event of the year is re:Invent, which occurred just after Thanksgiving from Dec 2-5 this year.

Products

AWS IAM Identity Centerby using your browser session.  This type of functionality had existed previously for AWS Identity Center users, using aws sso login, or through various open-source tools, such as Nike’s gimme-aws-creds,AWS SDKwhen I looked at how this was being implemented, I noticed functionality that was added to the AWS SDK earlier this year that records in the user-agent how credentials are acquired.  So you can see in yourCloudTrailearlier this year that records in the user-agent how credentials are acquired.  So you can see in your CloudTrail logs whether an application is using credentials acquired from this, the IMDS, or somewhere else.IAMIAM Outbound Identity Federationre:Inforcere:Inforce being merged into re:Inventre:InventAWS’s largest event of the year is re:Invent, which occurred just after Thanksgiving from Dec 2-5 this year.S3related to a static website and in addition to some paid tiers, it also offers a free tier with 5GB of S3 storage, WAF access, and other benefits, for a free way to host static sites on AWS.WAFto a static website and in addition to some paid tiers, it also offers a free tier with 5GB of S3 storage, WAF access, and other benefits, for a free way to host static sites on AWS.

Tools

aws loginThe new aws login command allows you to get credentials into a CLI (or other applications) by using your browser session.  This type of functionality had existed previously for AWS Identity Center users, using aws ssoaws sso loginsession.  This type of functionality had existed previously for AWS Identity Center users, using aws sso login, or through various open-source tools, such as Nike’s gimme-aws-creds, but this can now be used forgimme-aws-credsAWS Identity Center users, using aws sso login, or through various open-source tools, such as Nike’s gimme-aws-creds, but this can now be used for all sorts of account access scenarios and without the previous

Related Articles