In the event you’re utilizing AWS, it is simple to imagine your cloud safety is dealt with – however that is a harmful false impression. AWS secures its personal infrastructure, however safety inside a cloud setting stays the client’s accountability.
Consider AWS safety like defending a constructing: AWS offers robust partitions and a stable roof, however it’s as much as the client to deal with the locks, set up the alarm methods, and guarantee valuables aren’t left uncovered.
On this weblog, we’ll make clear what AWS would not safe, spotlight real-world vulnerabilities, and the way cloud safety scanners like Intruder may also help.
Understanding the AWS Shared Accountability Mannequin
AWS operates on a Shared Accountability Mannequin. In easy phrases:
- AWS is chargeable for securing the underlying infrastructure (e.g., {hardware}, networking, information facilities) – the “partitions and roof.”
- The shopper is chargeable for securing their information, purposes, and configurations inside AWS – the “locks and alarms.”
Understanding this distinction is important for sustaining a safe AWS setting.
5 Actual-World AWS Vulnerabilities You Must Tackle
Let’s take a look at some real-world vulnerabilities that fall below the client’s accountability and what could be accomplished to mitigate them.
Server-Facet Request Forgery (SSRF)
Purposes hosted in AWS are nonetheless susceptible to assaults like SSRF, the place attackers trick a server into making requests on their behalf. These assaults may end up in unauthorized information entry and additional exploitation.
To defend towards SSRF:
- Repeatedly scan and repair vulnerabilities in purposes.
- Allow AWS IMDSv2, which offers an extra safety layer towards SSRF assaults. AWS offers this safeguard, however configuration is the client’s accountability.
Entry Management Weaknesses
AWS Determine and Entry Administration (IAM) permits clients to handle who can entry what sources – however it’s solely as robust as its implementation. Prospects are chargeable for making certain customers and methods solely have entry to the sources they honestly want.
Widespread missteps embrace:
- Overly permissive roles and entry
- Lacking safety controls
- Unintentionally public S3 buckets
Information Exposures
AWS clients are chargeable for the safety of the info they retailer within the cloud – and for a way their purposes entry that information.
For instance, in case your software connects to an AWS Relational Database Service (RDS), the client should be certain that the appliance would not expose delicate information to attackers. A easy vulnerability like an Insecure Direct Object Reference (IDOR) is all it might take for an attacker with a consumer account to entry information belonging to all different customers.
Patch Administration
It nearly goes with out saying, however AWS doesn’t patch servers! Prospects who deploy EC2 situations are totally chargeable for conserving the working system (OS) and software program updated.
Take Redis deployed on Ubuntu 24.04 for instance – the client is chargeable for patching vulnerabilities in each the software program (Redis) and the OS (Ubuntu). AWS solely manages underlying {hardware} vulnerabilities, like firmware points.
AWS companies like Lambda cut back some patching duties, however you are still chargeable for utilizing supported runtimes and conserving issues updated.
Firewalls and Assault Floor
AWS offers clients management over their assault floor, however is not chargeable for what they select to show.
For example, if a GitLab server is deployed on AWS, the client is chargeable for layering it behind a VPN, utilizing a firewall, or inserting it inside a Digital Non-public Cloud (VPC) whereas making certain their staff has a safe technique to entry it. In any other case, a zero-day vulnerability may go away your information compromised, and AWS will not be at fault.
The Key Takeaway
These examples make one factor clear: cloud safety would not come out of the field. Whereas AWS secures the underlying infrastructure, the whole lot constructed on prime of it’s the buyer’s accountability. Overlooking that reality can expose a company to severe threat – however with the suitable instruments, staying safe is totally inside attain.
Stage Up Your Cloud Safety With Intruder
Intruder helps you keep forward of all these vulnerabilities and extra, by combining agentless cloud safety scanning, vulnerability scanning, and assault floor administration in a single highly effective, easy-to-use platform.
Why it is a sport changer:
- Discover what others miss: Intruder combines exterior vulnerability scanning with data from AWS accounts to seek out dangers that different options may miss.
- No false alarms: CSPM instruments can overhype severity. Intruder prioritizes actual dangers so you may deal with what actually issues.
- Crystal clear fixes: Points are defined in plain English with step-by-step remediation steering.
- Steady safety: Keep forward with steady monitoring and alerts when new dangers emerge.
- Predictable pricing: In contrast to different cloud safety instruments that may rack up unpredictable prices, there is not any shock prices with Intruder.
Get arrange in minutes and obtain immediate insights into your cloud safety – begin your 14 day free trial in the present day.