Free AI web copilot to create summaries, insights and extended knowledge, download it at here

5791

Abstract

7156">I covered user-specific secrets here:</p><div id="744d" class="link-block"> <a href="https://readmedium.com/create-a-per-user-secret-in-secrets-manager-part-1-bb97b66e2a2d"> <div> <div> <h2>User-Specific Secrets on AWS: IAM Policies</h2> <div><h3>ACM.82 IAM Policies to allow users to describe their own secrets</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*PcniDpBJq2db0jbdryc_Nw.png)"></div> </div> </div> </a> </div><h2 id="aada">Create the user-specific Secret to store the automation credentials</h2><p id="a515">Next I create <b>SandboxDevAutomationSecret</b> in Secrets Manager, encrypted with my <b>Sandbox KMS key</b>.</p><figure id="e15e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*DQonCyF8UzPnZZoiGOKD9w.png"><figcaption></figcaption></figure><figure id="f7b3"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*zITxEtD__wFDwpPrBpqv4w.png"><figcaption></figcaption></figure><h2 id="2e63">Create a user-specific EC2 instance role for the SandboxDev user</h2><p id="3417">Next I create an EC2 instance role that the developer is allowed to pass to EC2 instances named <b>SandboxDevEC2Role</b>.</p><figure id="44ef"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*__fohZeTWjwdYrS__B4imQ.png"><figcaption></figcaption></figure><p id="eee9">The role will have a prefix with the username:</p><figure id="7afa"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*7dKW5KiQMivtKqjgzA_1Gw.png"><figcaption></figcaption></figure><p id="a338">This role is granted access to:</p><ul><li>Read the<b> SandboxDevSecret.</b></li><li>Pull containers from the <b>sandbox Elastic Container Repository.</b></li><li>Use the <b>sandbox KMS key </b>to access decrypt the secret and the container in the repository</li></ul><h2 id="df90">Create the Automation user</h2><p id="b752">Create the <b>SandboxDevAutomation</b> user. Do not give this user console access.</p><figure id="ddeb"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*QWVvQMA9aDCtmiVxSR61iw.png"><figcaption></figcaption></figure><p id="c19e">Remember that I already have a role (<b>CloneGitHubtoCodeCommitRole</b>) used by my batch job from prior posts. Create a policy that allows the SandboxDevAutomation user to use STS to assume that role.</p><p id="559f">The <b>SandboxDev</b> user needs permission to change the <b>credentials</b> <b>and</b> MFA device of the <b>SandboxDevAutomation</b> user.</p><h2 id="0f53">Edit the batch job role trust policy to allow the SandboxDevAutomation role to assume it</h2><p id="7f1d">We need to modify the trust policy to allow the <b>SandboxDevAutomation</b> <b>user</b> to assume the <b>CloneGitHubtoCodeCommitRole</b> role with MFA.</p><figure id="6ad1"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*xAHGslW3SSbv6c5NO8mhzg.png"><figcaption></figcaption></figure><p id="7ad0">Edit the trust policy:</p><figure id="cfaf"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Vna71G_F2e-8Vdtw4yBwFw.png"><figcaption></figcaption></figure><p id="6a5a">Change the user to SandboxDev:</p><figure id="f788"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*vpSqEqjFa_qg59v_dnPCzQ.png"><figcaption></figcaption></figure><h2 id="49b3">Add permissions to KMS Key Resource Policy</h2><p id="8cf1">Next I need to allow the <b>SandboxDev</b> user to encrypt and decrypt and the <b>SanboxDevEC2Role</b> to decrypt with the <b>sandbox KMS Key.</b> I edit my automation to add those two roles to the encrypt and decrypt users.</p><figure id="380f"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*UkzCt10p0iqCR4OpMs6uhQ.png"><figcaption></figcaption></figure><h2 id="d015">Login as SandboxDev</h2><p id="725d">Log into the AWS Console with the SandboxDev user. If you’ve been following along, you have an account with a prefix specific to your organization and -Dev at the end if you used my deployment scripts.</p><figure id="13d5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*5L-3C9ORVXOWv6KRdCkBLg.png"><figcaption></figcaption></figure><h2 id="d260">Add MFA devices</h2><p id="5cca">Add a Hardware MFA device to the SandboxDev User.</p><figure id="21f0"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*8s8rTuyWOsLAQUEqfwTtOQ.png"><figcaption></figcaption></figure><p id="c0e6">Add a Virtual MFA device to the SandboxDevAutomation User.</p><p id="5cec">I explain why I do not use a Yubikey to generate MFA codes here:</p><div id="1308" class="link-block"> <a href="https://readmedium.com/the-yubikey-cli-and-aws-mfa-50e6be0698a7"> <div> <div> <h2>The Yubikey CLI and AWS MFA</h2> <div><h3>ACM.11 Considering the attack surface and MFA choices for our Security Batch Jobs</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*SFAKbcK__GlbJbJJJVXK9w.png)"></div> </div> </div> </a> </div><figure id="5893"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*iFl4DTQNuplt-SGONHpNYw.png"><figcaption></figcaption></figure><h2 id="d7df">Create automation credentials</h2><p id="b9e4">Create an <b>Access key</b> for the <b>SandboxDevAutomation</b> user.</p><figure id="7f1e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*KoVfxp-aJvzBiacPyFeMlA.png"><figcaption></figcap

Options

tion></figure><p id="217e">I have explained before that I disagree with the verbiage on this page. The CLI in the browser has a much larger attack surface and it depends how you are using the keys.</p><figure id="0423"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*_CCe4xu8AcNLloUHgvF5Aw.png"><figcaption></figcaption></figure><h2 id="8caa">Store the credentials in the SandboxDevAutomationSecret</h2><p id="24aa">Head to the Secrets Manager dashboard.</p><p id="432d">Click on the SandboxDevAutomationSecret.</p><figure id="6893"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*cz9jnYSnBsGXf9Y8VZjGPQ.png"><figcaption></figcaption></figure><p id="f616">Store the secret key id and secret access key.</p><figure id="4b95"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*-G9eR929nKSsGWrsOuzucg.png"><figcaption></figcaption></figure><h2 id="5496">Test Launching an EC2 Instance with the SandboxDev role</h2><p id="8907">Head over the EC2 dashboard and test launching an EC2 Instance. Recall that the Instance name needs to match what we specified in the policy above.</p><figure id="a1c7"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*FqCLLp7V854JJZa88TIdvA.png"><figcaption></figcaption></figure><p id="2bc8">If you need to decode any error messages I explained how to do that here:</p><div id="bb13" class="link-block"> <a href="https://readmedium.com/decoding-aws-error-messages-db0e0cbecf0d"> <div> <div> <h2>Decoding AWS Error Messages</h2> <div><h3>Free Content on Jobs in Cybersecurity | Sign up for the Email List</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*4oxP4LXk8l8c3mpRvO7ejg.png)"></div> </div> </div> </a> </div><p id="bd85">Choose the existing networking created for EC2 instances from prior posts.</p><div id="a149" class="link-block"> <a href="https://readmedium.com/automating-cybersecurity-metrics-890dfabb6198"> <div> <div> <h2>Automating Cybersecurity Metrics (ACM)</h2> <div><h3>A series of blog posts on cybersecurity metrics and security automation</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*L9lEIsaWt6xm2Op2ww-G5w.png)"></div> </div> </div> </a> </div><p id="2937">Choose the role we created under Advanced details.</p><figure id="8870"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*oHJior3Ueea6woDB1zqqKQ.png"><figcaption></figcaption></figure><p id="a822">One note that took me a bit to resolve. The message when your user does not have permission to pass the IAM role to the EC2 instance is a bit ambiguous.</p><div id="a0fb" class="link-block"> <a href="https://readmedium.com/ambiguous-error-message-when-a-user-doesnt-have-permission-to-pass-a-specific-iam-role-to-an-ec2-b005f338b6df"> <div> <div> <h2>Ambiguous Error Message When a User Doesn’t Have Permission to Pass a Specific IAM Role to an EC2…</h2> <div><h3>This error message needs to be more specific and doesn’t show up in CloudTrail for the User Name</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*4oxP4LXk8l8c3mpRvO7ejg.png)"></div> </div> </div> </a> </div><p id="51b2">Getting the resources setup took some time because I realized I had to revise my approach. I didn’t automate any of this but I will in the future. For now I just want to make sure it works. I can also figure out what permissions each policy requires.</p><p id="1fb5">I will test the initialization script in the next post.</p><p id="2c31">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="530b"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="eecf"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

10 Things You May Not Know About Me

I will tell you my story

I have been tagged by Vidya Sury, Collecting Smiles who will not listen to a ‘no’ or an answer as I will try to do it. She wants me to tell her and everyone else 10 things that people may not know about me. So here I go.

I think everyone knows that I am a Professor and my specialization is finance but I have varied interests in life. Whatever I write is what I have experienced in my life at home or in my career. I am a nature lover, I walk every day and also do yoga and little affirmations and small meditation mantras and the best thing are that I am very positive and eternally happy. I have a lot of challenges in my life but I overcome them with willpower and calmness.

I believe in uplifting the poor, developing women to be independent thinkers and have good sound careers, working for sustainable development in the country, and promoting love and peace.

My motto is Each Day Is Special — Live, Love, Laugh, and spread love and happiness

Now let me narrate some things about me that you may not know.

#1. My family lives on different continents

I have three sons who have flown from their nests and decided to move to other continents with their families and are happy citizens of other countries.

My eldest son lives in Australia and is an Australian Citizen. He has a daughter. She is half Indian and half Australian and her name is Isla. My middle son came back from the USA as he and his wife wanted to settle in India. He gave back his Green Card and rejected his application for citizenship coming back to his origin. They have two daughters Khushi and Trisha, and a cat and a dog as pets. My third son is a citizen of the USA. The couple is blessed with two sons Viraaj and Samraaj.

As a full family, we have never been together. Some family member is always missing. Now that we are four units, we meet as two units, three units but never as four units. We just cannot have a family picture together.

I have five grandkids the eldest Khushi will be 13 this year and the youngest Samraaj will be 7 on May 1st. He has been counting his birthday from Ist January 2022.

I have a picture to show with our three sons.

Author’s own picture — with the three sons

#2. My husband and I are opposites

I love to socialize and meet people. I am on the go, happy-go-lucky as I enjoy my life. He never wants to go out. He likes to spend time by himself at home. People say he is from the North pole and I am from the South Pole.

I love to walk but he does not like walking. I love to travel but he does not enjoy traveling.

He is humorous and has small jokes up his sleeve and I can never do that. He relates to some people who really enjoy his company.

We have spent 50 years of our life together. This is our Golden Anniversary Year.

#3. Dress to the occasion

I enjoy dressing for the occasion. I love to wear well-designed outfits and accessories and match everything when I go out. Often people ask me whether I bought the accessories first or the clothes. I enjoy designing clothes and jewelry. I did clothes designing in my own boutique but became so involved in academic work that I closed down because both could not go on side by side.

#4. My home as a kid

I lived in a home with a lot of love from my parents. The house was filled with flowers as my mother was so good at gardening. I was a perfect tomboy and loved to climb trees.

I am with my friend in the pictures below doing all sorts of naughty things. You would always find me perched upon a tree. I would do all my homework there. My mother would make beautiful frocks with hand embroidery and I would spoil them all dirtying them or tearing them and she would keep on sowing them.

Author’s own collection of pictures. (With flowers and on the trees)

#5 Butterflies in my stomach

When I used to go to a class on the first day I would have butterflies in my tummy and wonder if I could reach the end of the class. I wondered whether i could teach and what the students would think of me. This went on for 20 years but after that, I was cured of the silly phobia.

I would have the same kind of butterflies when I went on stage and speak but then later on I would speak extempore. I had to be on stage all the time as Head of the International Management Department and I never carried a paper with me. I needed a few points and I was ready. What a change from the olden days.

Author’s own picture collection.- Stage giving certificates

#6. Miss India contest

In my college days, I contested the Miss India contest and was a runner-up of Miss Hyderabad amidst a lot of cheering from my classmates and friends. I have a picture to show where I am standing next to the winner waiting to be crowned and given a sash, looking dazed and silly.

#7. College fun

I participated in a lot of debates, plays, dance, and other programs and functions held in the college. When I went on stage the boys and girls would call me a Bollywood actress Mala Sinha the then famous actress. Later they discarded that and called me Babita when this new actress came in as a Bollywood role.

#8. Academics

My father was very keen that I do a course other women did not do at that time. I did business studies. There were only 4 girls and 60 boys in my class in undergraduate and in my M.com class I was the only girl student with three sections of boys.

I was the first woman to do her Ph.D. in Finance from the Commerce Department of Delhi University, India.

I started my career as an assistant accountant and then went on in the higher education field by joining as a lecturer at Jesus and Mary College. I started the department and now there are women galore in the business field. I was the Head of the department and then moved on to post-graduate teaching and was again the Head of the Department of International management

I have been an entrepreneur having a fashion boutique as well.

#9. Cooking, embroidery, and other things

My mother wanted me to be proficient in housekeeping. She was too good. I do not think I could ever be like her but I did learn a lot of things.

I did learn to cook and embroider but not to sew making clothes. I can make minor adjustments and sew buttons and hooks but was not interested in making a whole garment. Instead, I had a talent for designing clothes and keeping a beautiful well designed home.

I am going to show you a sample of my embroidery. I did find a picture. I did a lot of cross stitch. You won’t believe me I learned other things like playing the sitar and had the opportunity of sitting on the stage in the background of the world-famous sitar player Ravi Shankar because my teacher was his disciple. I learned to paint but ever since I got married both the things I just left.

I also played hockey, badminton and throwball, and netball but now I don’t play these games at all.

Cross stitch -Picture from author’s collection

#10. I love traveling

Travel has taught me a lot. First I have learned to survive alone because I traveled alone so many times on assignments such as conferences as keynote speaker, chairperson, paper presenter, panelist, and teaching assignments. It took me to many countries abroad such as the USA, Canada, Germany, Sweden, Singapore, and Bangkok. I have also traveled to Australia, Austria France, the UK, Hungary, Finland, Hongkong, and Pakistan.

I have traveled to many places in India also both on assignments and personally.

I do not enjoy traveling alone even though I have to because when there are two people together you can see things from the other person’s viewpoint also. You can chat and do site seeing together.

I have traveled alone and also with friends and family. Each of these trips has taught me many life lessons.

I have now come to an end of the 10things. I have read many beautiful posts from others. I have seen so many people tagged.

5 names I did not see I am tagging them. Maybe they will enjoy writing. Dr. Fatima Imam, Noorain Ali, Josh Balerite Acol, Josephine Crispin Brajendra Kumar.

Please do read Vidya Sury, Collecting Smiles who has linked quite a few articles by people who have written about their 10 things

Ten Things You May Not Know About Me

Talking about ambulances, dancing, babies, travel, cooking, two left feet, and more!

medium.com

I invite you to join Medium by clicking my referral link. ‘Join Medium to Become A Member’