Best practices for securing AWS account - Revision history

Eyales at 15:02, 13 April 2020

2020-04-13T15:02:27Z

@@ Line 75: / Line 75: @@
 * Check the CIDR/IP value listed in the Details column for each authorized connection. If the security group contains any rules that have set the CIDR/IP to 0.0.0.0/0 and the Status to authorized, the selected DB security group configuration is insecure and does not restrict access to the database instance(s).
 * Configure the source CIDR/IP to the required subnet or required IP address.
 * Log off the AWS Management console.

Eyales at 15:01, 13 April 2020

2020-04-13T15:01:22Z

← Older revision		Revision as of 15:01, 13 April 2020
Line 53:		Line 53:
	* Change permissions so that no EBS volume snapshot is configured with public access.		* Change permissions so that no EBS volume snapshot is configured with public access.
	* Logoff the AWS Management console.		* Logoff the AWS Management console.

			== Amazon RDS Public Snapshots ==
			In-order to avoid data theft, it is recommended to make sure no Amazon RDS snapshots are configured with public access.
			* Login to the AWS Management Console.
			: https://console.aws.amazon.com/rds/
			* In the left navigation panel, under RDS Dashboard, click Snapshots.
			* Select Manual Snapshots from the Filter dropdown menu to display only manual database snapshots.
			* Select the snapshot that you want to examine.
			* Click Snapshot Actions button from the dashboard top menu and select Share Snapshot option.
			* On the Manage Snapshot Permissions page, check the DB Snapshot Visibility setting. If the setting value is set to Public, the selected Amazon RDS database snapshot is publicly accessible, therefore all AWS accounts and users have access to the data available on the snapshot.
			* Change permissions so that no Amazon RDS snapshot is configured with public access.
			* Logoff the AWS Management console.

			== Amazon RDS Security Group Access Risk ==
			Allowing unnecessary inbound access to Amazon RDS resources increase the chance of network breach.
			Limit the inbound access to your RDS instance to required sources only.
			* Login to the AWS Management Console
			: https://console.aws.amazon.com/rds/
			* In the navigation panel, under RDS Dashboard, click Security Groups.
			* Select the DB security group that you want to examine and click on the details button (magnifying glass icon).
			* Check the CIDR/IP value listed in the Details column for each authorized connection. If the security group contains any rules that have set the CIDR/IP to 0.0.0.0/0 and the Status to authorized, the selected DB security group configuration is insecure and does not restrict access to the database instance(s).
			* Configure the source CIDR/IP to the required subnet or required IP address.
			* Log off the AWS Management console.

Eyales at 14:58, 13 April 2020

2020-04-13T14:58:35Z

← Older revision		Revision as of 14:58, 13 April 2020
Line 43:		Line 43:
	: Note: It is highly recommended that inbound access on SSH (port 22TCP) or RDP (port 3389TCP) will be limited to specific IP address or IP range from known source location.		: Note: It is highly recommended that inbound access on SSH (port 22TCP) or RDP (port 3389TCP) will be limited to specific IP address or IP range from known source location.
	* Log off the AWS Management console.		* Log off the AWS Management console.

			== Amazon EBS Public Snapshots ==
			In-order to avoid data theft, it is recommended to make sure no Amazon EBS snapshots are configured with public access.
			* Open the Amazon EC2 console at
			: https://console.aws.amazon.com/ec2/
			* In the left navigation panel, under ELASTIC BLOCK STORE section, choose Snapshots.
			* Select the volume snapshot that you want to examine.
			* Select Permissions tab from the dashboard bottom panel and check the snapshot access permissions. If the selected EBS volume snapshot is publicly accessible, the EC2 dashboard will display the following status: "This snapshot is currently Public."
			* Change permissions so that no EBS volume snapshot is configured with public access.
			* Logoff the AWS Management console.

Eyales at 14:56, 13 April 2020

2020-04-13T14:56:22Z

@@ Line 31: / Line 31: @@
 :* Choose the name of the intended user, and then choose the Security credentials tab.
 :* Locate the access key to delete and choose its X button at the far right of the row. Then choose Delete to confirm.
 * Log off the AWS Management console.

Eyales at 14:54, 13 April 2020

2020-04-13T14:54:17Z

← Older revision		Revision as of 14:54, 13 April 2020
Line 12:		Line 12:
	* If you choose the option to generate a password, choose Show in the New password dialog box. This lets you view the password so you can share it with the user.		* If you choose the option to generate a password, choose Show in the New password dialog box. This lets you view the password so you can share it with the user.
	* Log off the AWS Management Console.		* Log off the AWS Management Console.

			== Changing IAM user access keys ==
			In-order to avoid potential compromise of credentials, it is recommended to replace every IAM user’s access keys, every 90 days.
			* While the first access key is still active, create a second access key.
			:* Sign in to the AWS Management Console and open the IAM console at
			:: https://console.aws.amazon.com/iam/
			:* In the navigation pane, choose Users.
			:* Choose the name of the intended user, and then choose the Security credentials tab.
			:* Choose Create access key and then choose Download .csv file to save the access key ID and secret access key to a .csv file on your computer. Store the file in a secure location. You will not have access to the secret access key again after this closes. After you have downloaded the .csv file, choose Close.
			* Update all applications and tools to use the new access key.
			* Determine whether the first access key is still in use by reviewing the Last used column for the oldest access key. One approach is to wait several days and then check the old access key for any use before proceeding.
			* Choose Make inactive to deactivate the first access key.
			* Use only the new access key to confirm that your applications are working.
			* After you wait some period of time to ensure that all applications and tools have been updated, you can delete the first access key:
			:* Sign in to the AWS Management Console and open the IAM console at
			:: https://console.aws.amazon.com/iam/
			:* In the navigation pane, choose Users.
			:* Choose the name of the intended user, and then choose the Security credentials tab.
			:* Locate the access key to delete and choose its X button at the far right of the row. Then choose Delete to confirm.
			* Log off the AWS Management console.

Eyales: Created page with "== Changing IAM user password == In-order to avoid potential compromise of credentials, it is recommended to replace every IAM user’s password, every 90 days. * Sign in to t..."

2020-04-13T14:51:09Z

Created page with "== Changing IAM user password == In-order to avoid potential compromise of credentials, it is recommended to replace every IAM user’s password, every 90 days. * Sign in to t..."

New page

== Changing IAM user password ==
In-order to avoid potential compromise of credentials, it is recommended to replace every IAM user’s password, every 90 days.
* Sign in to the AWS Management Console and open the IAM console at:
: https://console.aws.amazon.com/iam/
* In the navigation pane, choose Users.
* Choose the name of the user whose password you want to change.
* Choose the Security credentials tab, and then under Sign-in credentials, choose Manage password next to Console password.
* Choose whether to have IAM generate a password or create a custom password:
:* To have IAM generate a password, choose Autogenerated password.
:* To create a custom password, choose Custom password, and type the password.
* To require the user to create a new password when signing in, choose Require password reset. Then choose Apply.
* If you choose the option to generate a password, choose Show in the New password dialog box. This lets you view the password so you can share it with the user.
* Log off the AWS Management Console.