avatarGutbloom

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

5791

Abstract

7156">I covered user-specific secrets here:</p><div id="744d" class="link-block"> <a href="https://readmedium.com/create-a-per-user-secret-in-secrets-manager-part-1-bb97b66e2a2d"> <div> <div> <h2>User-Specific Secrets on AWS: IAM Policies</h2> <div><h3>ACM.82 IAM Policies to allow users to describe their own secrets</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*PcniDpBJq2db0jbdryc_Nw.png)"></div> </div> </div> </a> </div><h2 id="aada">Create the user-specific Secret to store the automation credentials</h2><p id="a515">Next I create <b>SandboxDevAutomationSecret</b> in Secrets Manager, encrypted with my <b>Sandbox KMS key</b>.</p><figure id="e15e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*DQonCyF8UzPnZZoiGOKD9w.png"><figcaption></figcaption></figure><figure id="f7b3"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*zITxEtD__wFDwpPrBpqv4w.png"><figcaption></figcaption></figure><h2 id="2e63">Create a user-specific EC2 instance role for the SandboxDev user</h2><p id="3417">Next I create an EC2 instance role that the developer is allowed to pass to EC2 instances named <b>SandboxDevEC2Role</b>.</p><figure id="44ef"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*__fohZeTWjwdYrS__B4imQ.png"><figcaption></figcaption></figure><p id="eee9">The role will have a prefix with the username:</p><figure id="7afa"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*7dKW5KiQMivtKqjgzA_1Gw.png"><figcaption></figcaption></figure><p id="a338">This role is granted access to:</p><ul><li>Read the<b> SandboxDevSecret.</b></li><li>Pull containers from the <b>sandbox Elastic Container Repository.</b></li><li>Use the <b>sandbox KMS key </b>to access decrypt the secret and the container in the repository</li></ul><h2 id="df90">Create the Automation user</h2><p id="b752">Create the <b>SandboxDevAutomation</b> user. Do not give this user console access.</p><figure id="ddeb"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*QWVvQMA9aDCtmiVxSR61iw.png"><figcaption></figcaption></figure><p id="c19e">Remember that I already have a role (<b>CloneGitHubtoCodeCommitRole</b>) used by my batch job from prior posts. Create a policy that allows the SandboxDevAutomation user to use STS to assume that role.</p><p id="559f">The <b>SandboxDev</b> user needs permission to change the <b>credentials</b> <b>and</b> MFA device of the <b>SandboxDevAutomation</b> user.</p><h2 id="0f53">Edit the batch job role trust policy to allow the SandboxDevAutomation role to assume it</h2><p id="7f1d">We need to modify the trust policy to allow the <b>SandboxDevAutomation</b> <b>user</b> to assume the <b>CloneGitHubtoCodeCommitRole</b> role with MFA.</p><figure id="6ad1"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*xAHGslW3SSbv6c5NO8mhzg.png"><figcaption></figcaption></figure><p id="7ad0">Edit the trust policy:</p><figure id="cfaf"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Vna71G_F2e-8Vdtw4yBwFw.png"><figcaption></figcaption></figure><p id="6a5a">Change the user to SandboxDev:</p><figure id="f788"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*vpSqEqjFa_qg59v_dnPCzQ.png"><figcaption></figcaption></figure><h2 id="49b3">Add permissions to KMS Key Resource Policy</h2><p id="8cf1">Next I need to allow the <b>SandboxDev</b> user to encrypt and decrypt and the <b>SanboxDevEC2Role</b> to decrypt with the <b>sandbox KMS Key.</b> I edit my automation to add those two roles to the encrypt and decrypt users.</p><figure id="380f"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*UkzCt10p0iqCR4OpMs6uhQ.png"><figcaption></figcaption></figure><h2 id="d015">Login as SandboxDev</h2><p id="725d">Log into the AWS Console with the SandboxDev user. If you’ve been following along, you have an account with a prefix specific to your organization and -Dev at the end if you used my deployment scripts.</p><figure id="13d5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*5L-3C9ORVXOWv6KRdCkBLg.png"><figcaption></figcaption></figure><h2 id="d260">Add MFA devices</h2><p id="5cca">Add a Hardware MFA device to the SandboxDev User.</p><figure id="21f0"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*8s8rTuyWOsLAQUEqfwTtOQ.png"><figcaption></figcaption></figure><p id="c0e6">Add a Virtual MFA device to the SandboxDevAutomation User.</p><p id="5cec">I explain why I do not use a Yubikey to generate MFA codes here:</p><div id="1308" class="link-block"> <a href="https://readmedium.com/the-yubikey-cli-and-aws-mfa-50e6be0698a7"> <div> <div> <h2>The Yubikey CLI and AWS MFA</h2> <div><h3>ACM.11 Considering the attack surface and MFA choices for our Security Batch Jobs</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*SFAKbcK__GlbJbJJJVXK9w.png)"></div> </div> </div> </a> </div><figure id="5893"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*iFl4DTQNuplt-SGONHpNYw.png"><figcaption></figcaption></figure><h2 id="d7df">Create automation credentials</h2><p id="b9e4">Create an <b>Access key</b> for the <b>SandboxDevAutomation</b> user.</p><figure id="7f1e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*KoVfxp-aJvzBiacPyFeMlA.png"><figcaption></figcap

Options

tion></figure><p id="217e">I have explained before that I disagree with the verbiage on this page. The CLI in the browser has a much larger attack surface and it depends how you are using the keys.</p><figure id="0423"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*_CCe4xu8AcNLloUHgvF5Aw.png"><figcaption></figcaption></figure><h2 id="8caa">Store the credentials in the SandboxDevAutomationSecret</h2><p id="24aa">Head to the Secrets Manager dashboard.</p><p id="432d">Click on the SandboxDevAutomationSecret.</p><figure id="6893"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*cz9jnYSnBsGXf9Y8VZjGPQ.png"><figcaption></figcaption></figure><p id="f616">Store the secret key id and secret access key.</p><figure id="4b95"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*-G9eR929nKSsGWrsOuzucg.png"><figcaption></figcaption></figure><h2 id="5496">Test Launching an EC2 Instance with the SandboxDev role</h2><p id="8907">Head over the EC2 dashboard and test launching an EC2 Instance. Recall that the Instance name needs to match what we specified in the policy above.</p><figure id="a1c7"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*FqCLLp7V854JJZa88TIdvA.png"><figcaption></figcaption></figure><p id="2bc8">If you need to decode any error messages I explained how to do that here:</p><div id="bb13" class="link-block"> <a href="https://readmedium.com/decoding-aws-error-messages-db0e0cbecf0d"> <div> <div> <h2>Decoding AWS Error Messages</h2> <div><h3>Free Content on Jobs in Cybersecurity | Sign up for the Email List</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*4oxP4LXk8l8c3mpRvO7ejg.png)"></div> </div> </div> </a> </div><p id="bd85">Choose the existing networking created for EC2 instances from prior posts.</p><div id="a149" class="link-block"> <a href="https://readmedium.com/automating-cybersecurity-metrics-890dfabb6198"> <div> <div> <h2>Automating Cybersecurity Metrics (ACM)</h2> <div><h3>A series of blog posts on cybersecurity metrics and security automation</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*L9lEIsaWt6xm2Op2ww-G5w.png)"></div> </div> </div> </a> </div><p id="2937">Choose the role we created under Advanced details.</p><figure id="8870"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*oHJior3Ueea6woDB1zqqKQ.png"><figcaption></figcaption></figure><p id="a822">One note that took me a bit to resolve. The message when your user does not have permission to pass the IAM role to the EC2 instance is a bit ambiguous.</p><div id="a0fb" class="link-block"> <a href="https://readmedium.com/ambiguous-error-message-when-a-user-doesnt-have-permission-to-pass-a-specific-iam-role-to-an-ec2-b005f338b6df"> <div> <div> <h2>Ambiguous Error Message When a User Doesn’t Have Permission to Pass a Specific IAM Role to an EC2…</h2> <div><h3>This error message needs to be more specific and doesn’t show up in CloudTrail for the User Name</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*4oxP4LXk8l8c3mpRvO7ejg.png)"></div> </div> </div> </a> </div><p id="51b2">Getting the resources setup took some time because I realized I had to revise my approach. I didn’t automate any of this but I will in the future. For now I just want to make sure it works. I can also figure out what permissions each policy requires.</p><p id="1fb5">I will test the initialization script in the next post.</p><p id="2c31">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="530b"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="eecf"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

Not Fixed Like the Northern Star

Trump as Caesar is offensive… offensively dumb, that is

The Public Theater’s decision to dress Julius Caesar as Donald Trump is the wardrobe choice that launched a thousand blog posts. When was the last time you heard anyone talking about theater? Theater? They still do live theater somewhere in this country? Where? Next to the venue where they hold harpsichord and recorder concerts?

Not only did I not watch the Tonys, I don’t know who hosted them and I couldn’t name a single play nominated, but that’s not going to stop me from commenting. I have big opinions about theater.

I understand I am stepping onto a crowded stage. There have been ample hot takes on the Trump as Caesar idea. Here is a pretty good one:

Now, I’m going to give you a bad one.

I understand that Julius Caesar was a dictator and a tyrant. I’ll concede that most of what I was taught about him is the work of his own propaganda machine, but comparing Trump to Julius Caesar is like comparing Norman Schwarzkopf to Alexander the Great, or Hilary Clinton to Hatshepsut. If Donald Trump is the modern Julius Caesar, then I’m today’s Diogenes the Cynic.

Here are some reasons why Donald Trump isn’t fit to hold Julius Caesar’s mantle.

Item 1: Julius Caesar Was Captured By Pirates

According to Plutarch, Caesar was captured by Cilician pirates. Plutarch writes:

First, when the pirates demanded a ransom of twenty talents, Caesar burst out laughing. They did not know, he said, who it was that they had captured, and he volunteered to pay fifty.

OK, I admit. That sounds a lot like Trump, but Plutarch goes on to say:

He also wrote poems and speeches which he read aloud to them, and if they failed to admire his work, he would call them to their faces illiterate savages, and would often laughingly threaten to have them all hanged. They were much taken with this and attributed his freedom of speech to a kind of simplicity in his character or boyish playfulness.

Two points of departure. Caesar wrote poems, and the pirates were charmed by Caesar. Last:

However, the ransom arrived from Miletus and, as soon as he had paid it and been set free, he immediately manned some ships and set sail from the harbor of Miletus against the pirates. He found them still there, lying at anchor off the island, and he captured nearly all of them.

He then had them all crucified. So, you know, he followed through on his threat.

What Trump Would Have to Do to Be Like Caesar in My Eyes

At 19 or 20, Donald Trump would have to have been taken hostage by the Gambino crime family. While being held in a basement in New Jersey, he would have had to come up to dinner each night, eaten spaghetti and meatballs at their table, and read excerpts of a screenplay, in which he, the hero informant, wore a wire that led to the RICO conviction of a bunch of mobsters. Then, after he got out of this jam, Trump would have to have gotten his friend Brutaliani to REALLY arrest and prosecute the mobsters who had taken him hostage. Then Trump would have had to visit one of the interrogation rooms and stuffed their faces full of spaghetti and meatballs to remind them that he meant what he said.

Trump didn’t do ANYTHING CLOSE TO THAT when he was a kid, and so, you see, Trump is no Caesar.

Item 2: Caesar Was a Seasoned Diplomat

Caesar was sent on a diplomatic mission to the kingdom of Bithynia, where he was supposed to raise a fleet and get the king of Bithynia to pay for it. Suetonius writes:

Being sent by Thermus to Bithynia, to fetch a fleet, [Caesar] dawdled so long at the court of Nicomedes that he was suspected of improper relations with the king…

In case you need translation, the second declension genitive absolute of “improper relations” is “hot gay sex.” OK, maybe it just means a love affair, I don’t know. I failed Latin. But what we have here is the King of Bithynia and young Julius Caesar “dawdling” for a long time. Maybe you can create a mental image that wouldn’t make the bill at Chicago’s Bijou Theater, but I sure can’t. Anyway, when he died, Nicomedes IV bequeathed the entire kingdom of Bithynia to Rome. That’s pretty nice cab fare, amirite?

Now, I’m going to ask you to be creative. Imagine a scenario where someone gives a kingdom to Donald Trump in exchange for sex. You can’t do it, can you? It’s impossible. Gay or straight, there is nobody on earth that would let young Donald Trump “dawdle” for even a day or two.

Item 3: Caesar Was a Priest

Julius Caesar was elected to the position of pontifex maximus, the high priest of Rome, in 63 B.C.E. Let’s just look at the first two duties of the pontifex maximus according to Wikipedia:

  1. The regulation of all expiatory ceremonials needed as a result of pestilence, lightning, etc.
  2. The consecration of all temples and other sacred places and objects dedicated to the gods.

Can you imagine Donald Trump being in charge of a religious consecration? The man has the ceremonial stateliness of a circus clown.

Imagine a plague hits our fair city. There is only one solution. Appeasement of the gods through a prescribed ceremony. And now, stepping into the temple wearing his priestly garb is… Donald Trump.

We’re fucked, right?

Item 4: Caesar Was a Soldier

Julius Caesar went to war. He was awarded the corona civica for his actions during a battle in Miletus when he was twenty. It was the second highest award in the Roman military and was bestowed on those that saved other citizens. The civic crown was made of oak leaves. When someone who had it wore it, even senators had to stand and applaud. When Caesar’s hair started to thin, he liked to wear the crown to cover his hairline. Yes, you got that right… Caesar had hair problems similar to Trump, but he fixed them by wearing a crown of valor.

In addition to being a capable warrior, Caesar was no slouch when it came to military command. He conquered Gaul, prevailed against Averni, fought the tactical donut, and brought Vercingetorix back to Rome in chains.

Donald Trump, by contrast, graduated from New York Military Academy, then received four draft deferments for college. After college, he avoided the draft by getting another deferment for heal spurs. I will give Trump props for one thing, though; he managed to heal himself after the war. That’s kind of rugged, isn’t it?

Item 5: Caesar Was Kind to the Poor

Sure, Caesar may have manipulated the poor for his own political purposes, but some of his bread and circuses were real bread and circuses. Among other measures to help the poor and unemployed, he cancelled a whole year of interest payments, eventually cancelling about a fourth of all debt. He allowed poor tenants to have a year’s reprieve from paying rent. He reinstated a law that placed a ceiling on the amount of cash any one person could hold. Most of his personal property was left to the public after his death.

What do you think the chances are that Donald Trump will leave Mar-a-Lago to the American people?

Item 5: Caesar Wrote His Own Book

I mentioned Vercingetorix earlier. Plutarch gives the following account of the great general’s surrender:

…and Vergentorix, who was the chief spring of all the war, putting his best armour on, and adorning his horse, rode out of the gates, and made a turn about Caesar as he was sitting, then quitting his horse, threw off his armour, and remained quietly sitting at Caesar’s feet until he was led away to be reserved for the triumph.

Caesar also reported on the surrender. In his Gallic Wars, Caesar, writing in the third person, says:

He [Caesar] himself took his seat in the entrenchments in front of the camp: the leaders were brought out to him there. Vercingetorix was surrendered, arms were thrown down.

Did you notice that Caesar’s own account of the surrender of Vercingetorix is LESS DRAMATIC than Plutarch’s? Can you think of a scenario where Donald Trump would offer a less bigly account of an enemy’s surrender than that of a contemporary historian?

Furthermore, Caesar’s The Conquest of Gaul has a 3.96 stars on Good Reads, while Donald Trump’s The Art of the Deal gets only gets 3.66. That’s a difference of three tenths of a point in a five-point scale. I’m not good with numbers… numbers are kind of like Latin declensions… but that sounds like a lot to me.

Item 6: Julius Caesar Was Not a Picky Eater

OK, I admit, I misremembered this quotation and thought it was said about Caesar. I remembered a line from Shakespeare that went:

Why, I have seen him drink the stale of horses and bore it so like a soldier that his face blanched not.

But the lines from Antony and Cleopatra are spoken by Octavius Caesar about Marc Antony.

…at thy heel Did famine follow, whom thou fought’st against, Though daintily brought up, with patience more Than savages could suffer. Thou didst drink The stale of horses and the gilded puddle Which beasts would cough at. Thy palate then did deign The roughest berry on the rudest hedge. Yea, like the stag, when snow the pasture sheets, The barks of trees thou browsèd. On the Alps It is reported thou didst eat strange flesh, Which some did die to look on. And all this — It wounds thine honor that I speak it now — Was borne so like a soldier, that thy cheek So much as lanked not.

So, Julius Caesar and Marc Antony were friends, right? It’s plausible that they shared a puddle of horse piss together, isn’t it? They were soldiers, after all.

Donald Trump has to get extra sauce with his chicken nuggets. He is a “picky eater” who insists on thousand island dressing when creamy vinaigrette is being served. He is not like a stag who browses on bark when the pastures are covered with snow. He is like a very fat rabbit who, faced with a field of clover and rye grass, prefers to nosh on the carrots of some poor, unsuspecting American farmer. A farmer too dumb to know that when you see a rat, you should pack sand in its rathole.

I have a cartoon knowledge of Julius Caesar, and a passing knowledge of Donald Trump, and even I know that Donald Trump is no Julius Caesar. Julius Caesar was a bonafide dictator, but with a dictator like that, who needs presidents?

Thank you for reading this far into the mire.

Shakespeare
Trump
Dreck
Funny
Humor
Recommended from ReadMedium