Cloud Security

16 readers

1 users here now

Preventing storms.

Rules

Be excellent to each other!
Use the article title as the submission title. Do not editorialize the title or add your own commentary to the article title.
No vendor spam. Zero tolerance for content marketing.

founded 1 year ago

MODERATORS

0xCBE@infosec.pub

How to get rid of AWS access keys- Part 1: The easy wins (www.wiz.io)

submitted 1 year ago by 0xCBE@infosec.pub to c/cloudsecurity@infosec.pub

4 comments fedilink hide all child comments

(I am not fond on vendor's blogs as the signal to noise ratio is very low, since they are written to please search engines more than engineers... but Scott Piper gets a pass.)

I found this insightful, access keys are such a liability that is better to tame as early as possible. Fixing the problem a scale is a lot more challenging.

top 3 comments

sorted by: hot top controversial new old

[–] 0xCBE@infosec.pub 3 points 1 year ago

I think access keys are a legacy authentication mechanism from a time where the objective was increasing cloud adoption and public clouds wanted to support customers to transition from on prem to cloud infra.

But for cloud native environments there are safer ways to authenticate.

A data point: for GCP now Google also advise new customers to enable from the start the org policy to disable service account key creation.

[–] lienmar@infosec.pub 1 points 1 year ago* (last edited 1 year ago)

Scott Piper is someone you definitely should have in your RSS-feed.

[–] Captain@infosec.pub 1 points 1 year ago

Getting rid of long living access keys is such a win.

Adding an SCP to block creation is mentioned last in the blog post, but I'd sat that's the first thing one should do. That way the problem won't grow as you remove the existing ones (which might take a lot of time).

Good blog post indeed! Not exactly ground breaking but considering how common the problem is I don't blame them for writing it.

load more comments