150 lines
5.7 KiB
Markdown
150 lines
5.7 KiB
Markdown
# Lab 3
|
|
|
|
## Prep
|
|
- [x] Gitea set up
|
|
- [x] MFA set up
|
|
- [x] Add git ignore
|
|
- [x] Secrets/Token Management
|
|
- [x] Consider secret-scanning
|
|
- [x] Added git-leaks on pre-commit hook
|
|
- [x] Create & Connect to a Git repository
|
|
- [x] https://code.wizards.cafe
|
|
- [x] Modify and make a second commit
|
|
|
|
|
|
|
|
- [x] Test to see if gitea actions works
|
|
- [x] Have an existing s3 bucket
|
|
|
|
## Resources
|
|
- [x] [Capital One Data Breach](./assets/Capital%20One%20Data%20Breach%20—%202019.%20Introduction%20_%20by%20Tanner%20Jones%20_%20Nerd%20For%20Tech%20_%20Medium.pdf)
|
|
- [x] [Grant IAM User Access to Only One S3 Bucket](./assets/Grant%20IAM%20User%20Access%20to%20Only%20One%20S3%20Bucket%20_%20Medium.pdf)
|
|
- [ ] [IAM Bucket Policies](./assets/From%20IAM%20to%20Bucket%20Policies_%20A%20Comprehensive%20Guide%20to%20S3%20Access%20Control%20with%20Console,%20CLI,%20and%20Terraform%20_%20by%20Mohasina%20Clt%20_%20Medium.pdf)
|
|
- [ ] [Dumping S3 Buckets!](https://www.youtube.com/watch?v=ITSZ8743MUk)
|
|
|
|
## Lab
|
|
- [x] create a custom IAM Policy
|
|
- [x] create an IAM Role for EC2
|
|
|
|
|
|
|
|
|
|
|
|
- [x] Attach the Role to your EC2 Instance
|
|
- [x] Verify is3 access from the EC2 Instance
|
|
* HTTPS outbound was not set up
|
|
* I did not check outbound rules (even when the lab explicitly called this out)
|
|
because it mentioned lab 2, so my assumption was that it had already been set up
|
|
(it was not). When connection to s3 failed I double checked lab 3 instructions
|
|
|
|
|
|
|
|
### Stretch
|
|
- [x] Create a bucket policy that blocks all public access but allows your IAM role
|
|
- [ ] Implmented: [guide](https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/)
|
|
|
|
|
|
|
|
- [x] **Experiment** with requiring MFA or VPC conditions.
|
|
- [x] MFA conditions
|
|
* MFA did not work out of the box after setting it in the s3 bucket policy.
|
|
The ways I found you can configure MFA:
|
|
* [stackoverflow](https://stackoverflow.com/questions/34795780/how-to-use-mfa-with-aws-cli)
|
|
* [official guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html)
|
|
* [x] via cli roles - I set up a new set of role-trust relationships.
|
|
Update s3 Role:
|
|
Update action: sts:assumerole
|
|
Update principle (for user -- could not target group)
|
|
Add condition (MFA bool must be true)
|
|
* Commands referenced: I set up a script that looks like this
|
|
|
|
```bash
|
|
MFA_TOKEN=$1
|
|
|
|
if [ -z "$1" ]; then
|
|
echo "Error: Run with MFA token!"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -z $BW_AWS_ACCOUNT_SECRET_ID ]; then
|
|
echo "env var BW_AWS_ACCOUNT_SECRET_ID must be set!"
|
|
exit 1
|
|
fi
|
|
|
|
AWS_SECRETS=$(bw get item $BW_AWS_ACCOUNT_SECRET_ID)
|
|
|
|
export AWS_ACCESS_KEY_ID=$(echo "$AWS_SECRETS" | jq -r '.fields[0].value')
|
|
export AWS_SECRET_ACCESS_KEY=$(echo "$AWS_SECRETS" | jq '.fields[1].value' | tr -d '"')
|
|
|
|
SESSION_OUTPUT=$(aws sts assume-role --role-arn $S3_ROLE --role-session-name $SESSION_TYPE --serial-number $MFA_IDENTIFIER --token-code $MFA_TOKEN)
|
|
#echo $SESSION_OUTPUT
|
|
export AWS_SESSION_TOKEN=$(echo "$SESSION_OUTPUT" | jq '.Credentials.SessionToken' | tr -d '"')
|
|
export AWS_ACCESS_KEY_ID=$(echo "$SESSION_OUTPUT" | jq '.Credentials.AccessKeyId' | tr -d '"')
|
|
export AWS_SECRET_ACCESS_KEY=$(echo "$SESSION_OUTPUT" | jq '.Credentials.SecretAccessKey' | tr -d '"')
|
|
#echo $AWS_SESSION_TOKEN
|
|
#echo $AWS_ACCESS_KEY_ID
|
|
#echo $AWS_SECRET_ACCESS_KEY
|
|
aws s3 ls s3://witch-lab-3
|
|
```
|
|
|
|
* configuration via ~/.aws/credentials
|
|
* 1Password CLI with AWS Plugin
|
|
* I use bitwarden, which also has an AWS Plugin
|
|
* I've seen a lot more recommendations (TBH it's more like 2 vs 0)
|
|
for 1password for password credential setup. Wonder why?
|
|
|
|
- [x] **Host a static site**
|
|
- [x] Enable a static website hosting (`index.html`)
|
|
- [x] Configure route 53 alias or CNAME for `resume.<yourdomain>` to the bucket endpoint.
|
|
- [x] Deploy CloudFront with ACM certificate for HTTPS
|
|
* see: [resume](https://resume.wizards.cafe)
|
|
- [ ] **Private "Invite-Only" Resume Hosting**
|
|
1. [ ] **Pre-signed URLs**
|
|
`aws s3 presign s3://<YOUR_BUCKET_NAME>/resume.pdf --expires-in 3600`
|
|
|
|
### Further Exploration
|
|
1. [ ] Snapshots & AMIs
|
|
- [ ] Create an EBS snapshot of `/dev/xvda`
|
|
- [ ] Register/create an AMI from that snapshot
|
|
- [ ] How do you "version" a server with snapshots? Why is this useful?
|
|
- [ ] Launch a new instance from your AMI
|
|
2. [ ] Linux & Security Tooling
|
|
3. [ ] Scripting & Automation
|
|
- [ ] Bash: report world-writable files
|
|
- [ ] Python with boto3: list snapshots, start/stop instances
|
|
|
|
## Further Reading
|
|
- [ ]
|
|
- [ ]
|
|
- [ ]
|
|
|
|
## Reflection
|
|
* What I built
|
|
* Challenges
|
|
* Groups cannot be used as the principal in a trust relationship
|
|
* The stretch goal for setting up s3 + mfa was a bit of a pain:
|
|
* The earlier lab had me set up a trust relationship on the role to allow EC2 as a principal
|
|
on the role
|
|
When I later updated IAM permissions to include MFA, I promptly forgot about this detail
|
|
and had chatgpt help me with troubleshooting. It was pretty good at helping me figure out
|
|
the issue
|
|
|
|
* Security concerns
|
|
On scale and security at scale
|
|
|
|
## Terms
|
|
### Identity Access Management
|
|
```mermaid
|
|
graph LR
|
|
IAMPolicy -- attaches to --> IAMIdentity
|
|
ExplainIAMIdentity[users, groups of users, roles, AWS resources]:::aside
|
|
ExplainIAMIdentity -.-> IAMIdentity
|
|
classDef aside stroke-dasharray: 5 5, stroke-width:2px;
|
|
```
|
|
|
|
## End lab
|
|
- [ ] On June 20, 2025, do the following:
|
|
- [ ] Clean up
|
|
- [ ] Custom roles
|
|
- [ ] Custom policies
|
|
- [ ] Shut down ec2 Instance |