Five Security-Focused Talks from AWS re:Invent 2022
Summary
A roundup of five AWS re:Invent talks covers Netflix’s multi-account architecture and SDK instrumentation, zero-privilege service design, AWS’s Log4Shell response, and cloud security posture management.
Key points
- Netflix described separating compute into a shared account from application resources and IAM roles, using EC2 proxies to provide role credentials from the application accounts.
- Netflix speakers presented an SDK-based approach to recording AWS API calls and parameters, addressing visibility limits in other methods.
- An AWS talk discussed mechanisms intended to prevent employees from accessing customer data and how others could apply similar concepts.
- An AWS security engineer described the company’s Log4Shell response, including cross-team escalation, impact assessment, and operational coordination.
- A Wiz and MGM Studios talk discussed cloud-native application protection for securing AWS deployments.
Article Details
- Topic
- Selected security talks at AWS re:Invent 2022
People
Abby FullerDiscussed AWS’s response to Log4Shell in the BOA204 session.Colm MacCárthaighDiscussed mechanisms for preventing AWS employees from accessing customer data in the SEC327 session.John VisneskiGuest speaker discussing CNAPP and AWS deployments in the PRT254 session.Joseph KjarDiscussed Netflix’s multi-account deployment approach in the NFX305 session.Nick SiowDiscussed AWS SDK instrumentation for recording application API calls in the NFX302 session.Patrick SandersDiscussed Netflix’s multi-account deployment approach in the NFX305 session.Prateek SharmaDiscussed Netflix’s multi-account deployment approach in the NFX305 and NFX302 sessions.Scott PackDiscussed AWS SDK instrumentation for recording application API calls in the NFX302 session.Yinon CosticaDiscussed Wiz and CNAPP in the PRT254 session.
Vendors
Amazon Web ServicesAWS re:Invent took place last week in Las Vegas with around 50,000 attendees and 2,750 sessions. AWS has already uploaded over 700 videos of the more popular sessions, which is over 3 weeks of content if watchedWiz(PRT254)—I'm biased in liking this talk, but in it, Yinon Costica, co-founder and VP Product at Wiz, and guest speaker John Visneski, CISO at MGM Studios, give a great explanation on what Wiz does and the
Products
Access Advisorthe AWS API calls made by applications. There are various limitations to using CloudTrail logs, Access Advisor, client-side monitoring, and network proxying to get full visibility into the AWS API calls made. InAWS X-Rayexplain how they use existing, but poorly documented, SDK functionality they discovered when looking at AWS X-Ray in order to see all the calls and the parameters used. CloudTrailby Netflix to record the AWS API calls made by applications. There are various limitations to using CloudTrail logs, Access Advisor, client-side monitoring, and network proxying to get full visibility into the AWSIAMbut is only compute. They then use individual application accounts for other resources and for the IAM roles of those applications that are in turn passed to the EC2s in that monolithic account! The EC2s run