My AWS Access Key Nightmares... and Solutions

Emily Gladstone Cole @UnixGeekEm
My AWS Access Key
Nightmares… and Solutions

Agenda
1. Introduction
2. Nightmare #1: Access Keys in Source Code
3. Nightmare #2: Old Access Keys
4. Nightmare #3: Keys on Disk
5. Access Key Best Practices

Who is this Emily Person Anyway?
PAST
CURRENT
FUN FACTS
● UNIX SysAdmin/Operations background
● Experience in Security Incident Response, Security Research,
Security Engineering
● Senior Security Engineer at
● Mentor for SANS’ Women’s CyberTalent Immersion Academy
● My favorite computer game is Nethack
● None of the cats you will see here today are mine

Disclaimers
I am not aﬃliated with Amazon or AWS.
I’m not being paid to give this talk.
I’m sharing what I have learned. There
are many others who know more about
AWS and Access Keys than I do. Some of
them are cited in the references.

What is an AWS Access Key?
Access Key ID:
● Always starts with AKIA…
● Is the equivalent to your username
Secret Access Key:
● Secret really means secret
● Treat this key like a password

When your Access Key is
compromised, an attacker
can do anything you can.

For those of
you who
already knew
all this, this
slide is for
you.
On to the
good stuﬀ!

Nightmare #1
Access Keys in Source Code

Access Keys in Source Code
When the repo is public, this means almost instant
compromise of the keys.
Remember: attackers can do anything you can, using
your Access Key and Secret Key.
● View and copy customer data
● Bitcoin Mining

Oh shhgit

How can YOU ﬁnd Access Keys in Source Code?
We can detect them with source code scanners!
● truﬄeHog
● git-secrets
● detect-secrets (can be run as a pre-commit hook)!

What if I ﬁnd an Access Key
● Rotate the key so it’s no longer valid
● Delete the commit that contained the Access Key so it’s not
sitting in the commit history
● Talk with your Dev team about storing keys diﬀerently

DIY Honeypots: Canary Tokens
Canary Tokens are one implementation of a honeytoken.
● Can be in the form of a document, a key, a QR code, a DNS record…
● Alerts can be generated when the token is accessed, either to an email
address or a webhook
● You can know if someone is in your data
● Your Dev team will probably ﬁnd this idea fun

Nightmare #2
Old Access Keys

Access Keys get old
The longer an Access Key is around, the greater the chance it can be found
somewhere it shouldn’t.

The longer Access Keys are
around, the higher the
chances something may
happen to them accidentally.

Solution: Rotate your Access Keys
You can rotate your Access Keys manually, and it’s fairly straightforward.
There are tools to help you rotate your Access Keys automatically, like
aws-rotate-iam-keys which works well for individuals, but for application
users, it’s not that simple.

Nightmare #3
Access Keys On Disk

Bars and Cars

Other ways to expose keys on disk
● Store them in environment variables
● Write them to log ﬁles
● Expose them through the Amazon Meta Data service v1 (Capital One)

Hide Access Keys: aws-vault and vault
Using a vault tool will allow you to store your keys in a keystore, and interact
with the pointers, not the actual keys.
I don’t recommend storing shared AWS Access Keys in password managers.

Don’t use permanent Access Keys at all
● Security Token Service can generate temporary credentials
○ Credentials inherently expire
● Roles use STS to delegate permissions
○ Roles can be created with Policies assigned
○ Can be used to grant access to a user in another account (cross-account)
○ Can be used by instances or applications

Access Key Best
Practices

If you were napping during the
ﬁrst part of my talk, here’s a
quick meme to catch you up.

Squad Goals: Access Keys are accessible only when needed
● Don’t have permanently-valid Keys sitting around in your source code
● Don’t have them sitting on disk
● Don’t have them loaded in environment variables
● Do have Keys that are only valid for a short amount of time
● Do have unique Keys for each user and application
● Only request a Key when you are about to use it

Coming Soon: SSO and AWS
Can be used with Okta, Onelogin, Ping...
Here are some Okta-based integrations:
● okta-aws
● okta-awscli
● okta-aws-cli-assume-role
● AWS recently came out with an Okta integration as well!
Tying AWS into our SSO provider is our next step. We haven’t built that yet at
my company, but we’re working on it right now.

References
1. truffleHog: https://github.com/dxa4481/truffleHog
2. git-secrets: https://github.com/awslabs/git-secrets
3. detect-secrets: https://github.com/Yelp/detect-secrets
4. shhgit: https://shhgit.darkport.co.uk/
5. Canary Tokens: https://canarytokens.org/generate
6. Cuckoo’s Egg: https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg
7. aws-rotate-iam-keys: https://github.com/rhyeal/aws-rotate-iam-keys
8. aws-vault: https://github.com/99designs/aws-vault
9. https://github.com/RiotGames/key-conjurer
10. Vault: https://www.vaultproject.io/docs
11. Amazon Meta Data Service v2:
https://blog.appsecco.com/getting-started-with-version-2-of-aws-ec2-instance-metadata-service-imdsv
2-2ad03a1f3650
12. https://static.sched.com/hosted_files/bsidessf2020/83/How%20to%20Kill%20an%20Access%20Key%20
rev%2020200223.pdf

Thank you!

My AWS Access Key Nightmares... and Solutions

Recomendados

Recomendados

Más contenido relacionado

Similar a My AWS Access Key Nightmares... and Solutions

Similar a My AWS Access Key Nightmares... and Solutions (20)

Último

Último (20)

My AWS Access Key Nightmares... and Solutions