Do you secure your @awscloud access?
11 secrets hackers don't want you to know 📈.
Number 7 will blow your mind 🤯
A thread 🔽🔽🔽
#AWSCommunity
11 secrets hackers don't want you to know 📈.
Number 7 will blow your mind 🤯
A thread 🔽🔽🔽
#AWSCommunity
0.❌Never use the root access keys; remove those and create restricted users as soon as possible.
Protect the root account with MFA immediately.
Protect the root account with MFA immediately.
2.🛑 Do NOT use permanent programmatic access keys.
Force rotation with the shortest period.
Force rotation with the shortest period.
3.👥 Use AWS SSO with federated identity to your company identity provider.
Or use the IAM role federated with your identity provider, and generate short-lived credentials for programmatic access.
Start using Leapp for this:
Or use the IAM role federated with your identity provider, and generate short-lived credentials for programmatic access.
Start using Leapp for this:
https://twitter.com/a_cava94/status/1497232005758603266
5.🚫Restrict the instance sizes and types that can be used by the accounts.
Use SCP to achieve this:
docs.aws.amazon.com/organizations/…
Use SCP to achieve this:
docs.aws.amazon.com/organizations/…
6. ‼️ Always use STS to get short-lived access tokens.
This can be hard for developers, rely on a tool to do that
github.com/Noovolari/leapp
This can be hard for developers, rely on a tool to do that
github.com/Noovolari/leapp
8. 🫰 Restrict all the expensive services your account doesn't need, like machine learning services, if you just use basic workloads.
9.🤯 Use AWS access analyzer to ensure you have the least privilege properly set up.
Don't miss this session by @bjohnso5y for this!
Don't miss this session by @bjohnso5y for this!
10.🚫 Never use credentials inside a repository, even if it is local.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
