Cloud Summit Canada com Rodrigo Montoro

The deFAULT truth
of AWS Shared
Responsibility
Model
Rodrigo Montoro
Head of Threat & Detection Research
@spookerlabs

$ aws --profile Rodrigo Montoro sts get-caller-identity
Clavis Segurança da Informação
● Head of Threat & Detection Research at Clavis Security
● Living in Florianópolis (Silicon Island)
● Author of 2 patented technologies (US Patent Office)
● Speaker in different conferences (Brazil,USA,Canada)
● Proud Dad and Husband
● Full Ironman triathlon (2x)
● Crossfit and Powerlifting

Some numbers(*) about security ‘IN’ the cloud (AWS)
● CSPM Detections (cloudsploit)
○ 460 findings (AWS)
○ 87 services covered (around 29% of services)
● Services with Passrole
○ 330 actions
○ 92 services (around 30.7% of services)
● Detections from Elastic rules
○ 59 detections
○ ~22 services covered (around 7.3% of services)
● Detections from Sigma
○ 31 detections
○ ~20 services covered (around 6.7% of services)
* based on my analysis in open source tool and public content

With some ideas in mind …

Security Operations Center (SOC)
AGENDA
1
AWS ecosystem / Control Plane
DeFAULT Design
Data Plane
1
1
Cross Account
1
Uncommon Services
Conclusions

7
AWS Ecosystem / Control Plane

AWS Shared Responsibility Model

AWS In Numbers
● Around 13k actions
● 973 Managed policies
● Around 300 Services
● 18 regions
● 5 actions access level
Source: https://aws.permissions.cloud/

How authentication and authorization works

AWS IAM policy flow analysis

Management Events

13
DeFAULT Design

How many problems an AWS account start (with an Admin user) ?

Next let’s add an ec2 instance

Just to finish a s3 bucket …

Simple scenario (only 3 services) the "deFAULT problems”

Some more details
● VPC Endpoint
○ Policy Resource : *
● IAM
○ Managed Policies
■ Resource: *
■ No Conditional
■ No control

service enumeration is possible by design with account id
source: https://www.sidechannel.blog/en/enumerating-services-in-aws-accounts-in-an-anonymous-and-unauthenticated-manner/

20
Data Plane

Data Plane
● S3 buckets data events
● RDS Audit logs
● EKS (Kubernetes)

S3 buckets

VPC Flow Logs

GuardDuty
source: https://xmind.app/m/K3fmSB/#
Events analyzed are NOT saved. Only the
payload saved is the content that triggered
the finding.

25
Cross Account

What is Cross Account ?
source: https://aws.amazon.com/blogs/security/how-to-audit-cross-account-roles-using-aws-cloudtrail-and-amazon-cloudwatch-events/

Vendors / Partners
● Splunk history
● ReadOnlyAccess policy

Splunk history

ReadOnlyAccess World (1/3) - Unwanted Permissions
source: https://www.sidechannel.blog/en/unwanted-permissions-that-may-impact-security-when-using-the-readonlyaccess-policy-in-aws/
● s3:GetObject
● lambda:GetFunction
● ec2:DescribeInstanceAttribute
● dynamodb:{Query,Scan}
● cloudtrail:LookupEvents

ReadOnlyAccess World (2/3) - bad use everywhere
source: https://www.wiz.io/blog/82-of-companies-unknowingly-give-3rd-parties-access-to-all-their-cloud-data

ReadOnlyAccess World (3/3) - Sample of products
Tenable -
https://docs.tenable.com/tenablecs/quick-reference/AWS/Content/QuickReference/SetUpA
WSReadOnlyAccess.htm
Site24x7 - https://www.site24x7.com/help/aws/enable-aws-account-access.html
NewRelic -
https://docs.newrelic.com/docs/infrastructure/amazon-integrations/get-started/integrations-
managed-policies/
Autocloud - https://docs.autocloud.dev/aws-account
DivvyCloud - https://docs.divvycloud.com/docs/policies (some minor denies
http://get.divvycloud.com/policies/ReadOnlywithAWSReadOnly.json )
Cloudockit - https://www.cloudockit.com/documentation/aws-create-user-for-cloudockit/
Hava.io - https://docs.hava.io/importing/aws/getting-started-with-aws/read-only-iam-user
Cloudcraft - https://help.cloudcraft.co/article/87-connect-aws-account-with-cloudcraft

32
Uncommon Services

What do I consider uncommon ?
● Services without security research related
○ big part of 300 services
○ almost 13000 actions
● Very specific services with only "few" customers

So what is _REALLY_ uncommon ? How about Identity Center (SSO)?

Passrole world
source: https://twitter.com/noamdahan/status/1349384948998922240

Appstream 2.0 Edition

37
Future & Conclusions

Future and Conclusions
● Make sure you understand default configurations
● Validate cross account / partners permissions
● Know what you are running
● Find your knowledge gaps
● Keep researching and improving detections
● Make sure you train your team

Thank you!
See you at Sector
Rodrigo Montoro
@spookerlabs
rodrigo.montoro@clavis.com.br

Cloud Summit Canada com Rodrigo Montoro

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Cloud Summit Canada com Rodrigo Montoro

Similar to Cloud Summit Canada com Rodrigo Montoro (20)

More from Clavis Segurança da Informação

More from Clavis Segurança da Informação (20)

Recently uploaded

Recently uploaded (20)

Cloud Summit Canada com Rodrigo Montoro