Mapping your AWS attack surface

1

Steampipe

An Organization must monitor and understand the network perimeter of their cloud estate. Resources comprising the externally facing network components of your cloud attack surface can be broadly grouped into IP addresses, hostnames, and URLs. In this blog post, we will provide step-by-step instructions for mapping the network aspects of the cloud attack surface using Steampipe.

#Big Data #Databases #Big Data Analytics 41 social mentions

2

Nmap

Review the list of IP addresses returned, and if permitted by the terms of service, scan these hostnames for exposed ports and services using nmap or Nessus.

#Security #Security Monitoring #Monitoring Tools 200 social mentions

3

Amazon S3

A number of AWS services, including CloudFront, S3, API Gateway, and AWS Lambda, produce URLs that can be vulnerable. For example, S3 Buckets exist as URLs on the public internet and can be accessed if the bucket is not properly secured. To get a list of all of the URLs for the public buckets in your cloud environment, you can use this query:.

#Cloud Hosting #Object Storage #Cloud Storage 196 social mentions

4

Amazon Route 53

To determine the DNS Hostnames used as part of your cloud perimeter, Steampipe can query all of the A records and CNAMEs in your Route 53 Hosted Zones. A records point directly to IP addresses under your control. CNAMEs are references that can point to hosts or other cloud-provider-managed resources. In either case, you need to understand what exists in your environment.

#Cloud Computing #Domain Name Registrar #Domain Names 48 social mentions

5

Amazon CloudFront

A number of AWS services, including CloudFront, S3, API Gateway, and AWS Lambda, produce URLs that can be vulnerable. For example, S3 Buckets exist as URLs on the public internet and can be accessed if the bucket is not properly secured. To get a list of all of the URLs for the public buckets in your cloud environment, you can use this query:.

#CDN #Cloud Computing #Content Distribution 78 social mentions

6

AWS Certificate Manager

Note: The above query excludes private DNS for VPCs z.private_zone=false and excludes common CNAMEs needed for ACM and email validation.

#Identity And Access Management #Two Factor Authentication #Network & Admin 24 social mentions

7

Amazon API Gateway

A number of AWS services, including CloudFront, S3, API Gateway, and AWS Lambda, produce URLs that can be vulnerable. For example, S3 Buckets exist as URLs on the public internet and can be accessed if the bucket is not properly secured. To get a list of all of the URLs for the public buckets in your cloud environment, you can use this query:.

#API Tools #APIs #Web Service Automation 107 social mentions