AWS
Building a business with continuous delivery and Serverless
Hey – I’m back! I’ve been heads-down learning what Cloud teams need to deliver to AWS securely and make IAM usable, and building that into a business delivered via SaaS & infrastructure code libraries: k9 Security. I’d like to share my experience in how continuous delivery and serverless supported that endeavor. I hope this experience
Never felt more DevOps than when I was Serverless
Serverless helped me integrate DevOps principles into my application delivery workflow like never before.
Video: Secure an S3 Bucket
Last week I presented ‘Secure an S3 Bucket (and still use it)’ at the Phoenix DevOps meetup. I’m trying to help people understand why and how to protect every S3 bucket with data that needs to remain confidential. We hosted the meetup using Zoom. Attendee participation was strong and people said the content was on-target,
Why protecting data in S3 is hard and a least-privilege bucket policy to help
Securing data in S3 is a nightmare for many people. This post describes why it’s hard and a least-privilege bucket policy to help.
Computing a Risk Estimate using Netflix’s riskquant
This post computes a realistic annual loss estimate in dollars for an ecommerce application using the riskquant tool that models the distribution of possible impacts and probabilities appropriately.
Modeling Risk in Cloud Deployments
Information Security risks are those risks “that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations, organizational assets, individuals, other organizations, and the Nation (NIST 800-30).” Risk assessments should help people understand a given Cloud deployment’s information security risks and help
Modeling Security in Cloud Deployments
Cloud deployments often use tagging to describe the context of a compute or resource such as a who owns or what application a virtual machine or object storage bucket belongs to. However, the common resource tagging models in use don’t describe the context required for people or tools to assess security or manage risk easily.
The context people and tools need to work with your Cloud
Operating applications involving more than a few components without explicitly modeled contextual clues is difficult for humans and might be impossible for tools. This is especially true when people are a couple steps removed such as is often the case when analyzing costs and/or assessing risk. Both people and tools rely on: identifying resources at
Research: Problems with top free security assessment tools (2020q1)
I’m researching how engineers assess the security posture of their Cloud deployments and evaluate risk to those deployments so they can improve it. Reading Time: 10 minutes The research starts with these questions: What’s the hardest part about assessing and improving the security of your Cloud deployments? When was the last time you tried or
Understanding risk using top free AWS Security tools
Most free security assessment tools for AWS will only go so far as to highlighting potential risk areas — assessing risk is up to you.
Continuous Delivery with Serverless, CircleCI, and Lambda: The Good, Bad, and the YAML
Our Serverless continuous delivery pipeline lets us achieve Elite levels of Software Delivery Performance.
Cloud native application-level identity and access control
The proper way to provide identities to applications on Cloud and container platforms is for the compute platform to provide that identity to the application instance . I call this the Cloud native application identity. Once the application has received its identity from the compute platform along with an identity document or credential the application
Better Network-based Identity and Access Control in the Cloud
This is the second post in a series about how the Cloud is changing how we manage network access control and application identity. In particular, my thesis is that the use of a network-centric identity such as an IP address or subnet to identify an application is waning and are being replaced by identities provided
Cloud Pattern: Secure Inbox using S3 and KMS
With the Secure Inbox pattern, organization A can store and deliver objects of arbitrary size to partners while narrowly scoping what partner data its own teams and applications have access to. Organization B can receive work generated by partners reliably and securely while maintaining tight control over who has access to that data via KMS encryption key and bucket policy.
Debugging AccessDenied in AWS IAM
Ugh… that looks like it could be the start of a two hour or two week long goose chase. Understanding why access was denied and implementing a secure solution can be complicated. Sometimes it’s not even clear where to start and what to do when you get stuck. Update: An improved version of this Debugging
Which career path to the Cloud?
I had an interesting conversation yesterday with someone looking for advice on how to add ‘Cloud’ to their career path. They have more than ten years experience architecting and delivering projects in enterprise IT along with a couple of ‘simple’ migrations to AWS. They started off with a couple of questions: Should I try to
Why is AWS IAM So Hard?
Why is AWS IAM so @!#^$!# hard? One of my favorite Directors of Cloud Platform AWS Identity and Access Management (IAM) is a security tool that controls access what AWS API actions that Principals (roles, users) are allowed to perform on which AWS resources: an S3 bucket, EC2 instance, DynamoDB table, etc. IAM is really
Choose Container Orchestrators Strategically
Deciding which of container orchestrator is right for your organization or team now and in the future is an exercise in strategy. This post will help you develop a strategy aligned to your specific customer needs, technological and organizational assets, desired business state, and other information required to build a good strategy.
What is different about Elastic Container Service (ECS)
ECS is a first class container orchestration platform for teams committed to AWS. If you’re in one of the ‘best for’ categories, give it a serious look.
Prototyping helps clear the err
Reading time: 2.5 minutes We create and review designs primarily in our minds. While our expertise is worth a lot, we’re not perfect and neither are our diagrams. We’re still subject to: known-knowns we think are true, but aren’t known-unknowns we uncovered in the design process unknown-unknowns we didn’t forsee One of the ways we
Preventing 3rd-Parties from Leaking Data in Cloud – Attunity
Let’s examine three controls customers can adopt to help keep control of their data stored in S3 or another Cloud object store while still making it accessible or manageable by third parties.
Provable Security at AWS
Helping customers answer security questions in the general case and preventing bad configurations from making it into the wild is one of the main themes at AWS’ inaugural Security conference, re:Inforce. They have done this by operationalizing the ‘Provable Security’ field for their services.
On the Deceitful Complexity of Cloud Security
This post shares a QualiMente Cloud Engineer’s experience and key learnings from taking the AWS Security Fundamentals Course: these pieces *do* tie together.
Building Security Skills for an AWS Cloud Migration
The Security skills needed for a Cloud migration may be in shortest supply and the most difficult to acquire. This post describes resources you can use to build Security skills throughout your engineering team and to integrate your Security Engineers with greater leverage.
Heartbleed’s lesson about delivering change
Investing in robust delivery processes to lower the minimum time for an idea to go to concept to customer is not at odds with security, ‘stability’, and customer happiness. In fact, a robust delivery pipeline is a mechanism by which you can achieve all of these.
Consuming Secrets in Applications
Explore the three main methods, advantages, and disadvantages for applications to consume (use) secrets stored in a vault: environment variable, file, and API.
The First Secret Problem
Your application’s compute execution role is its identity in the Cloud. Use it to bootstrap access to runtime secrets in addition to authenticating to other provider-managed services.
What is a Cloud?
The Cloud changes the economics of application deployments by shifting to pay-for-what-you-use consumption based model. You can and should use the Cloud’s resource provisioning APIs to allocate resources when you need them and release them when you’re finished to create an economical deployemnt.
Continuous Integration for Infrastructure Code
Continuous Integration can and should be applied to infrastructure code written in tools like Terraform and CloudFormation. This post describes how.
Mapping a Safer, Faster IAM Development and Review Process
I used Wardley mapping this morning to explore ideas I have for improving the development and review of AWS Identity and Access Management (IAM) policy changes. I’d like to share the internals of that mapping process with you to give you an illustrated example. The purpose of this process improvement effort is to help people
The Promise of Clouds and Optionality
The real magic Cloud providers give you is optionality to build the right thing.
Starting Carefully with Service Control Policy
Let’s say you’re excited about using Service Control Policy to govern what goes on in your organization’s AWS accounts and improve compliance, but you don’t want to break the world when you roll it out. How do you do that? Start by identifying a single account that serves an active, but low risk use case
Improving Enterprise Security and Compliance with AWS Organizations
Let’s examine how AWS Organizations helps you manage and improve some aspects of Enterprise-wide security and compliance. This discussion builds on the previous post detailing how AWS Organizations help you manage many AWS accounts and their costs. AWS Organizations provide a number of additional security features, the one we’ll examine today is Service Control Policy.
Managing Multiple AWS Accounts and Costs with an AWS Organization
Previously, we explored the benefits of the security and fault boundaries provided by AWS accounts, and provisioning accounts to match your use cases in order to operate safely in the Cloud. Today, we’ll explore the AWS Organization service and why you should use it to manage your enterprise’s AWS accounts. When you deploy distinct use
How should I organize my AWS accounts?
Previously, I answered ‘How many AWS accounts do I need?’ with: Create however many accounts your organization needs to establish safe security and fault boundaries that enable your organization’s primary use cases and expected level of team/application autonomy. Today, we’ll explore the tradeoffs of AWS account organization methods using an example that covers one approach
How many AWS accounts do I need?
Today, I’d like to answer a common question people ask about AWS accounts: How many AWS accounts do we need? What’s an AWS Account? First let’s start with some background about what an AWS Account is and the features it provides. An AWS Account is a logical container that owns resources in the AWS Cloud.