Baking Safety In From the Floor Up on AWS | by Teri Radichel | Cloud Safety | Feb, 2023 | Zombie Tech

Begin from scratch in a brand new AWS account and construct a safe structure

This can be a recap and a little bit of group of my collection on Automation of cybersecurity metrics. He Code.

After I began scripting this collection on automating safety metrics, I used to be going to create a primary safety structure for the safe automation of batch jobs. In truth, I need to use this framework in my very own enterprise for penetration testing and safety assessments.

The issue was that after I received to the road utilizing an account the place I had AWS Management Tower deployed and was utilizing AWS SSO from AWS Identification Heart, I bumped into too many issues. I made a decision to start out over at that time and create a brand new AWS account and group from scratch utilizing AWS IAM, probably with Okta because the IdP. (You may also use Azure AD in an identical method.) I attempted utilizing AWS Management Tower and AWS SSO, however I bumped into too many issues.

Right here is the preliminary publish the place I began to rebuild with some rationalization as to why. It supplies plenty of safety suggestions to contemplate when creating a brand new AWS account, so issues ended up a bit out of order.

If you wish to go forward and create an account from scratch, you can begin right here and proceed.

From then on, I am going to construct every little thing I’ve carried out up to now into a brand new AWS account. Anybody who follows it may well attempt to create their very own account and be taught cloud safety within the course of. The ideas are additionally relevant to Azure and GCP, which I point out periodically, however the terminology and particular implementation will differ.

So does beginning over in a brand new account imply I will need to throw away all of the code I’ve already written? Completely not. I am already reusing the code I used to implement CloudFormation stacks with a naming conference that helps you:

• Determine the kind of useful resource
• Determine who applied it
• Solely permits a task to change its personal stacks.

A part of the above features a widespread capabilities file used for the implementation of all assets. That is nonetheless related as I’m beginning my AWS account from scratch.

I made a decision to attempt integrating with Okta to forestall privilege escalation as described in these posts.

My code for IAM capabilities remains to be related, however must be modified to match the format of capabilities used with SAML federation.

All the opposite IAM roles and insurance policies I created are nonetheless legitimate, however they are going to have to be modified to be SAML roles, and I will hold the IAM and SAML roles within the listing so individuals can use whichever one works in their very own atmosphere. . I am undecided if I am nonetheless utilizing AWS Teams.

When you rebuild the IAM framework, a lot of the remainder of your code will keep the identical. We’ll nonetheless use the only KMS key CloudFormation template I created to deploy keys throughout our group, however we’ll most likely begin cross-account entry.

Please observe that the important thing coverage above acquired some tweaks as I found some points because the collection progressed. Learn all of the KMS posts for extra data and a few AWS KMS-related points you may want to pay attention to.

Our community structure can also be reusable. That does not change a lot. Verify the underside of this listing for posts associated to the community.

I am working down plenty of rabbit holes whereas implementing all of this code. I begin in a single course and find yourself on a windy street exploring another problem or security requirement that got here alongside the best way. It is all a part of one thing I’ve wished to do for a very long time: construct a code framework for a safe cloud infrastructure from scratch in a brand new account and group. We won’t overlook the inconvenient particulars. In truth, I wrote about security-related points right here:

I like to think about this collection of blogs as these individuals who watch different individuals play video video games on-line. You’ll be able to watch me write and troubleshoot code, though I am not doing it in a dwell video stream (but). I’ve a normal define, however the posts will evolve as I am going alongside.

I began placing a number of the posts behind a paywall as a result of it is a very time consuming endeavor and sure I have to make a dwelling. We’ll see how that works. Perhaps Medium pays me greater than $2 per thirty days. It already will increase my funds a bit, but it surely’s nowhere close to what I must do to write down full time and publish multiple publish a day.

As I get into the main points of making an IdP, it begins to get difficult and takes much more time. Additionally, Okta shouldn’t be low-cost. For anybody who does not like paywalls, I get it. I discover it tough to pay for each information supply that wishes me to pay for a subscription. However take into account this: You can afford a $7,000 class like those you used to show for a sure group.

Or you may assist an writer and join Medium utilizing my referral hyperlink.

You will get a every day dose of sensible cloud safety suggestions that can assist you enhance the safety of your cloud account. You may also get sufficient data to go an AWS safety certification in case you are curious about that. I am going to cowl all of it ultimately, if I can.

However that is what I do not know. I take advantage of revenue after I refer a brand new subscriber, however I’ve no method of realizing if I truly received paid for somebody I referred. In the event you join as a referral of mine, please let me know so I can see if I obtain the suitable referral charge. As a result of I do know I get precisely one referral per thirty days, each time, which appears bizarre. By no means zero, two or 5, all the time one.

I get just a few different pennies when individuals learn or like posts, however I do not even perceive the way it all works. I am too busy to search out out.

An alternative choice to the paywall can be to spend so much of time turning this right into a e-book, pay a writer, and put the ultimate chapters within the e-book like I did with my collection on cybersecurity for executives. You would want to purchase the e-book to get the ultimate chapters which I consider cowl crucial points of organizational safety. Additionally, the e-book could have fewer typos. 🙂

It is laborious to know the best way to proceed as an writer as a result of there’s a lot data on the market and also you need to ensure you’re offering worth. On the similar time, authors additionally have to earn a dwelling. No, I do not need to write a e-book for Packt or educate by means of a 3rd occasion. Folks can attain out straight in the event that they need to take a category from me on LinkedIn. I write lessons too. The newest class I taught was a 6 week two hour class on Azure Safety. I educate by means of IANS Analysis, however you will want to work with them to rearrange a contract with a 50% down fee.

In any case, I’ll proceed to publish some free and a few paid posts in an effort to assist as many individuals as potential whereas working by means of this safe cloud structure from the bottom up. I additionally admire if individuals publish points on GitHub and I am going to attempt to repair them. I do not all the time see them instantly, however I’ll ultimately get to them. The code is on the market at no cost, there isn’t any paywall in the intervening time. 🙂

Observe for updates.

Teri Radichel | © second sight lab 2023

Like this story? Present your help so I can write extra!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Clap for this story or refer others to comply with me.
Observe on Medium: Teri Radichel
Join for Electronic mail Listing: Teri Radichel
Observe on Twitter: @teriradichel
Observe on Mastodon: @[email protected]
Observe on Publish: @teriradichel
Observe or Like on Fb: 2nd Sight Lab
Observe or like on YouTube: @2ndsightlab
Purchase a Guide: Teri Radichel on Amazon
Purchase me a espresso: Teri Radichel
Request a penetration check, safety evaluation, or coaching
by way of LinkedIn: Teri Radichel 
Schedule a consulting name with me by means of IANS Analysis

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
Slideshare: Shows by Teri Radichel 
Speakerdeck: Shows by Teri Radichel
Recognition: SANS Distinction Makers Award, AWS Hero, IANS College
Certifications: SANS
Schooling: BA Enterprise, Grasp of Sofware Engineering, Grasp of Infosec
How I received into safety: Lady in tech
Firm ~ Cloud Penetration Exams, Assessments, Coaching ~ 2nd Sight Lab

Cybersecurity for executives within the cloud period at Amazon