avatarAndrew Masa

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

5791

Abstract

7156">I covered user-specific secrets here:</p><div id="744d" class="link-block"> <a href="https://readmedium.com/create-a-per-user-secret-in-secrets-manager-part-1-bb97b66e2a2d"> <div> <div> <h2>User-Specific Secrets on AWS: IAM Policies</h2> <div><h3>ACM.82 IAM Policies to allow users to describe their own secrets</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*PcniDpBJq2db0jbdryc_Nw.png)"></div> </div> </div> </a> </div><h2 id="aada">Create the user-specific Secret to store the automation credentials</h2><p id="a515">Next I create <b>SandboxDevAutomationSecret</b> in Secrets Manager, encrypted with my <b>Sandbox KMS key</b>.</p><figure id="e15e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*DQonCyF8UzPnZZoiGOKD9w.png"><figcaption></figcaption></figure><figure id="f7b3"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*zITxEtD__wFDwpPrBpqv4w.png"><figcaption></figcaption></figure><h2 id="2e63">Create a user-specific EC2 instance role for the SandboxDev user</h2><p id="3417">Next I create an EC2 instance role that the developer is allowed to pass to EC2 instances named <b>SandboxDevEC2Role</b>.</p><figure id="44ef"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*__fohZeTWjwdYrS__B4imQ.png"><figcaption></figcaption></figure><p id="eee9">The role will have a prefix with the username:</p><figure id="7afa"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*7dKW5KiQMivtKqjgzA_1Gw.png"><figcaption></figcaption></figure><p id="a338">This role is granted access to:</p><ul><li>Read the<b> SandboxDevSecret.</b></li><li>Pull containers from the <b>sandbox Elastic Container Repository.</b></li><li>Use the <b>sandbox KMS key </b>to access decrypt the secret and the container in the repository</li></ul><h2 id="df90">Create the Automation user</h2><p id="b752">Create the <b>SandboxDevAutomation</b> user. Do not give this user console access.</p><figure id="ddeb"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*QWVvQMA9aDCtmiVxSR61iw.png"><figcaption></figcaption></figure><p id="c19e">Remember that I already have a role (<b>CloneGitHubtoCodeCommitRole</b>) used by my batch job from prior posts. Create a policy that allows the SandboxDevAutomation user to use STS to assume that role.</p><p id="559f">The <b>SandboxDev</b> user needs permission to change the <b>credentials</b> <b>and</b> MFA device of the <b>SandboxDevAutomation</b> user.</p><h2 id="0f53">Edit the batch job role trust policy to allow the SandboxDevAutomation role to assume it</h2><p id="7f1d">We need to modify the trust policy to allow the <b>SandboxDevAutomation</b> <b>user</b> to assume the <b>CloneGitHubtoCodeCommitRole</b> role with MFA.</p><figure id="6ad1"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*xAHGslW3SSbv6c5NO8mhzg.png"><figcaption></figcaption></figure><p id="7ad0">Edit the trust policy:</p><figure id="cfaf"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Vna71G_F2e-8Vdtw4yBwFw.png"><figcaption></figcaption></figure><p id="6a5a">Change the user to SandboxDev:</p><figure id="f788"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*vpSqEqjFa_qg59v_dnPCzQ.png"><figcaption></figcaption></figure><h2 id="49b3">Add permissions to KMS Key Resource Policy</h2><p id="8cf1">Next I need to allow the <b>SandboxDev</b> user to encrypt and decrypt and the <b>SanboxDevEC2Role</b> to decrypt with the <b>sandbox KMS Key.</b> I edit my automation to add those two roles to the encrypt and decrypt users.</p><figure id="380f"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*UkzCt10p0iqCR4OpMs6uhQ.png"><figcaption></figcaption></figure><h2 id="d015">Login as SandboxDev</h2><p id="725d">Log into the AWS Console with the SandboxDev user. If you’ve been following along, you have an account with a prefix specific to your organization and -Dev at the end if you used my deployment scripts.</p><figure id="13d5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*5L-3C9ORVXOWv6KRdCkBLg.png"><figcaption></figcaption></figure><h2 id="d260">Add MFA devices</h2><p id="5cca">Add a Hardware MFA device to the SandboxDev User.</p><figure id="21f0"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*8s8rTuyWOsLAQUEqfwTtOQ.png"><figcaption></figcaption></figure><p id="c0e6">Add a Virtual MFA device to the SandboxDevAutomation User.</p><p id="5cec">I explain why I do not use a Yubikey to generate MFA codes here:</p><div id="1308" class="link-block"> <a href="https://readmedium.com/the-yubikey-cli-and-aws-mfa-50e6be0698a7"> <div> <div> <h2>The Yubikey CLI and AWS MFA</h2> <div><h3>ACM.11 Considering the attack surface and MFA choices for our Security Batch Jobs</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*SFAKbcK__GlbJbJJJVXK9w.png)"></div> </div> </div> </a> </div><figure id="5893"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*iFl4DTQNuplt-SGONHpNYw.png"><figcaption></figcaption></figure><h2 id="d7df">Create automation credentials</h2><p id="b9e4">Create an <b>Access key</b> for the <b>SandboxDevAutomation</b> user.</p><figure id="7f1e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*KoVfxp-aJvzBiacPyFeMlA.png"><figcaption></figcap

Options

tion></figure><p id="217e">I have explained before that I disagree with the verbiage on this page. The CLI in the browser has a much larger attack surface and it depends how you are using the keys.</p><figure id="0423"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*_CCe4xu8AcNLloUHgvF5Aw.png"><figcaption></figcaption></figure><h2 id="8caa">Store the credentials in the SandboxDevAutomationSecret</h2><p id="24aa">Head to the Secrets Manager dashboard.</p><p id="432d">Click on the SandboxDevAutomationSecret.</p><figure id="6893"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*cz9jnYSnBsGXf9Y8VZjGPQ.png"><figcaption></figcaption></figure><p id="f616">Store the secret key id and secret access key.</p><figure id="4b95"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*-G9eR929nKSsGWrsOuzucg.png"><figcaption></figcaption></figure><h2 id="5496">Test Launching an EC2 Instance with the SandboxDev role</h2><p id="8907">Head over the EC2 dashboard and test launching an EC2 Instance. Recall that the Instance name needs to match what we specified in the policy above.</p><figure id="a1c7"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*FqCLLp7V854JJZa88TIdvA.png"><figcaption></figcaption></figure><p id="2bc8">If you need to decode any error messages I explained how to do that here:</p><div id="bb13" class="link-block"> <a href="https://readmedium.com/decoding-aws-error-messages-db0e0cbecf0d"> <div> <div> <h2>Decoding AWS Error Messages</h2> <div><h3>Free Content on Jobs in Cybersecurity | Sign up for the Email List</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*4oxP4LXk8l8c3mpRvO7ejg.png)"></div> </div> </div> </a> </div><p id="bd85">Choose the existing networking created for EC2 instances from prior posts.</p><div id="a149" class="link-block"> <a href="https://readmedium.com/automating-cybersecurity-metrics-890dfabb6198"> <div> <div> <h2>Automating Cybersecurity Metrics (ACM)</h2> <div><h3>A series of blog posts on cybersecurity metrics and security automation</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*L9lEIsaWt6xm2Op2ww-G5w.png)"></div> </div> </div> </a> </div><p id="2937">Choose the role we created under Advanced details.</p><figure id="8870"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*oHJior3Ueea6woDB1zqqKQ.png"><figcaption></figcaption></figure><p id="a822">One note that took me a bit to resolve. The message when your user does not have permission to pass the IAM role to the EC2 instance is a bit ambiguous.</p><div id="a0fb" class="link-block"> <a href="https://readmedium.com/ambiguous-error-message-when-a-user-doesnt-have-permission-to-pass-a-specific-iam-role-to-an-ec2-b005f338b6df"> <div> <div> <h2>Ambiguous Error Message When a User Doesn’t Have Permission to Pass a Specific IAM Role to an EC2…</h2> <div><h3>This error message needs to be more specific and doesn’t show up in CloudTrail for the User Name</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*4oxP4LXk8l8c3mpRvO7ejg.png)"></div> </div> </div> </a> </div><p id="51b2">Getting the resources setup took some time because I realized I had to revise my approach. I didn’t automate any of this but I will in the future. For now I just want to make sure it works. I can also figure out what permissions each policy requires.</p><p id="1fb5">I will test the initialization script in the next post.</p><p id="2c31">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="530b"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="eecf"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

People Watching in Soi Cowboy — Bangkok’s Infamous Red-light District

Photo by Frida Aguilar Estrada Unsplash

It’s 11 pm, and I’m camped out at The Oasis, one of the only bars in Soi Cowboy that is nothing more than a pub. There’s some live music downstairs, billiards on the second floor, and fortunately for me, a patio where I can people-watch from above without anyone catching my glance.

Soi Cowboy seems to be more a spectacle, not as cutthroat as Nana Plaza, where innocent tourists can dart through from one side to the other unscathed, other than a few arm pulls from a couple of ladyboys. The scene is entertaining, to say the least.

I watch as a Japanese couple is being coaxed inside a bar by an older woman in a more traditional Thai dress. I’ve read about these “mamasans”, a respected role within the go-go bar community. She’s the elder leader of the girls — the store manager you could say — and each bar typically has one. The mamasans have been in the trenches, having successfully danced themselves in the prime of their vitality, though perhaps not successfully enough to escape the industry as they get older. The mamasans coach and groom the girls, manage their day-to-day lives, represent them against the bureaucracies above, and console them through the emotional turmoil that comes with the job.

The Japanese couple nervously accepts the invite and makes their way in. Two minutes later, they’re both darting out of the club in complete dismay.

I enjoy my pint next to a Western man, who looks to be in his sixties, accompanied by a Thai woman, likely in her early thirties. The back and forth is comical, almost too good to be true.

“You’re so silly! Hahaha, you’re such a silly girl”

“I know, I so silly. Why you like me Paul? Why you like?”

“Oh, because you’re beautiful, myyyy beautiful girl. Give me a kiss, c’mon.”

I have to give it to her, she has the whole thing mastered, working him up the entire time like someone who’s on the clock: a smile that never breaks, a well timed laugh, the way she strokes his leg — which has now evolved into a firm grip of his crotch.

I turn my attention back to the street. A go-go bar across the way has a couple of girls out front dressed a bit more modestly in tight dresses versus the neon bikinis of their peers. I assume they are hostesses, perhaps go-go dancers in training but not yet graduated to the center stage. Nevertheless, they do their part with just as much vivaciousness as they smile at prospects and invite them in. It’s much more tasteful than the aggressive ladyboys down the block.

One of the girls stands out from the rest, not because she’s necessarily the most beautiful, though in a way, maybe she is. She has jet-black hair, even cut at her shoulders, and an endearing smile with a slight overbite. Her breasts and buttocks are noticeably modest compared to her peers, but it’s a body untouched by the demanding expectations of the red lights. This girl doesn’t look like anybody else on the street. She looks like a colleague you fail to notice initially and then fall in love with over time. The girl next door. I watch as she points to the drink deal on her sign and waves to guests as they pass by. I notice how her face still lights up even when she’s chatting it up with her colleagues. How she playfully assists the merchants as they deliver crates of beer.

It’s all very endearing, but you should know how the industry works here in the red-light districts of Bangkok. Whether it’s the go-go dancers, the hostesses, the waitstaff, hell, even the cleaning lady — everyone plays the game.

“Hello, welcome!”

“Hi.”

Every step since the patio at The Oasis has been an automation over which I possessed no control. Now that I’m closer, she’s even more enthralling than before. When we make eye contact, the chaos around me blurs, and the music muffles.

“Would you like to come in? Only one person?”

“Oh, no. I just, uh, I would like to…pay your bar fine or your shift. So, you don’t have to work anymore tonight.”

None of my readings could have prepared me for this.

“Oh, you want to pay for me?”

“Um, yes,” the phrasing kills me, but I stay strong.

She calls over her mamasan, an eccentric lady that I truly felt deserved my respect. She explained my request, and the mamasan nodded and smiled at me as if I was asking her daughter out. I felt inclined to make a good impression.

The mamasan insists that I also come in and buy a few drinks and hang out a while, maybe see some other dancers. But I express how I’m only interested in the hostess. I plead with her with a boyish smile and put my hands together to jokingly beg. She reluctantly obliged — this is the land of smiles, after all — and signaled to the hostess to go back inside to change and get ready to leave.

“One thousand baht for short time, two thousand for all night. She not dancer, so she much cheaper. Good for you.”

It’s shocking to hear a service list in such a way, and I dare not negotiate. I accept the terms for the all-night and am instructed that I pay the hostess when everything is satisfactory. The logistics make me nervous, and I’m starting to get cold feet.

Right before I bail, the hostess reappears from the bar door and stops me in my tracks. A tasteful checkered skirt, black tank top, light white jacket, and a side bag that could be perceived as a laptop carrier versus an overnighter. This is common practice, dressing modestly to slide by hotel front desks that would prefer not to be a stomping ground for sleazy sexpats. She could blend right in at a hip tech job downtown.

The mamasan sends us off, and my new companion playfully interlinks my arm so I can walk her down the street to begin our time together.

“Where do you stay?” She asks.

“Oh, just a few minutes away. Would you like to grab a small bite first? It’s still early.”

“Oh…ok. If you like,” she says with a smile.

We find a typical Thai food stand with metal tables and plastic stools lined up along the sidewalk. I order a couple of bowls of piping hot street noodles.

Once we sit down, I’m still uneasy, yet she comfortably sits across from me as if it’s a routine date night. She jumps into her bowl, making a satisfying face when sipping the hot broth.

“What’s your name?” I ask.

“My name is Anong. What is your name?”

Her English is impressive, far better than many of the go-go girls trying to lure me in the entire night. I tell her my name, and we break through some of the basic introductions.

She’s from Isaan, just like many of the workers in Bangkok, and though the depiction of her upbringing in the North has likely been rehearsed to garner my emotional investment, it’s probably not that far from the truth.

Many of these girls come from incredibly difficult situations back home, especially the ones from the devastatingly poor villages across the Isaan provinces. The opportunities they acquire here in Bangkok can uplift an entire family and a handful of distant relatives. With that comes tremendous pressure from their family to continue working. Even their boyfriends and husbands — if they can somehow manage — leech off of them for all they can. Ironically, the issues that typically arise in their relationships aren’t even about the sex; it’s about the money.

I know all this, though Anong doesn’t yet know that I know all this.

“By the way, I’m only here for tonight,” I say, “and I won’t be back in Thailand again for a long time.”

It’s not true, but I wanted to put her at ease.

Often, these encounters are a trial for a longer arrangement. It’s not just about the one-nighters; men often come here looking for an armpiece to join them for the rest of their vacation. If the girls play their cards right, they can expand their nightly rate to a daily or weekly, and with that comes an all-expenses-paid vacation to the beaches in the South.

Anong picks up on what I’m implying. In fact, she’s incredibly intuitive about the whole thing.

“Ok, I guess we just have fun for one night,” she says with a dainty smile.

The conversation takes a profound shift now that Anong knows there’s no upsell. Suddenly, I can ask deeper and more nuanced questions.

I discovered that she learned English from her older sister, who worked in the industry, while Anong was just a girl. How she would listen in to her sister's conversations on speaker phone as her sister would reassure a half dozen men at a time that she was desperately waiting for their return to Thailand, eternally grateful she no longer had to work in the horrible clubs because of the monthly allowance they were sending back.

She tells me how she took it upon herself to learn how to read and write as well. This way, she can eventually manage her communication with her customers instead of relying on a scribe to write out any emails, texts, and letters on her behalf. Western customers often want to keep tabs on the girls, but most of the girls can’t read or write English. Thus, a third-party scribe is available for a fee to assist the girls in providing reassurances or fending off any suspicions from distant boyfriends.

“No baby, I only love you. I wait for you only! I just stay in my house, no more dancing!”

Ironically, these men also have to navigate any suspicions from their wives back home, so a phone call is not always convenient.

Having seen her older sister go through this line of work before, Anong is optimistic that she can make even more money, especially after she saves up enough to enhance her body to meet the standards required to succeed on the stage. I tell her that I think she’s already beautiful, but she dismisses my comment because she isn’t talking about beauty — she is talking about business.

“You really don’t have to change a thing, you know,” I say.

“You’re so nice,” she says. Shrugging off my compliment as if my naivety garnered pity.

I continue to ask her about her upbringing.

Eventually, I read between the lines and presumed that there was some serious abuse that she had suffered from her parents. After all, they seem uncomfortably eager for her to begin this new endeavor in Bangkok. There was even a notion that her father coaxed her into similar arrangements around town across her early teens. Despite this, she insists that it’s all been worth it because she’s finally broken into the Soi Cowboy scene.

Anong seems to be a natural at whatever this is, listening intently to every word that comes from my mouth. I feel as if I’m finally being perceived in ways I could only fantasize before. My jokes made her laugh, my stories were captivating, and my stares made her blush.

“The way you look at me right now, who taught you that?” I ask.

I’m referring to her gleaming eyes and innocent expression that makes me feel like I’m the only person in the world.

It’s not uncommon, after all, for men to fall madly for these women who are trained in the art of building up the egos of the West. As long as the money still comes in, a dancer will willingly ditch the pole and be readily available for your return trips back to Thailand(at least, that’s what she’ll tell you). If you want to take things even further, the girls will happily accompany you back to your homeland to help make your mates jealous. As I said, the most successful girls don’t become mamasans. They retire at twenty-five in Switzerland. As I sit across the table from Anong, I can finally understand how this might happen.

“What do you mean?” She says, politely showing confusion.

“You know, the way you smile, laugh, just the way you look at everyone.”

She laughs, “No, that’s just me. That’s just who I am.”

“I don’t believe you,” I say.

Her smile disappeared, and I could see she was hurt. It was the most validating moment of the entire night. Suddenly us, everything, life, didn’t feel so superficial.

We can be truly happy, and we can also be achingly sad.

Anong awkwardly stirs her spoon in her now empty bowl, trying to find the next best thing to say. Her mamasan hadn’t rehearsed her through this situation before, it seems.

“Ok, I believe you now,” I say.

I reach into my wallet, grab two thousand baht, and put it on the table.

“I’m sorry, I have to go now.”

She looks at me with confusion, afraid that perhaps she did something wrong. I give her a reassuring smile to try and convince her that she hasn’t.

As I walk away, I want to turn around, but I’m afraid to. The automation in my movement has resurfaced from before.

“Whoops, sorry bout that!”

The old man beside me at The Oasis bumped into my chair as he hobbled up to leave.

My head jerks, and I break my deep stare from my empty beer glass.

“Haha, didn’t mean to startle you, son. Have a good night now!”

His Thai companion gives me an endearing smile and a small head bow to apologize on behalf of her partner — or should I say — client.

I smile back and wish them a good night in return.

The music is blaring now that I’m out of my head and in tune with my surroundings.

When I peer back down to the go-go bar, the hostess is no longer in sight. The fraudulent couple next to me is quickly replaced by two husky guys in button-up shirts drinking mega pints of beer.

I ready myself to leave when suddenly the hostess, whom I’ve named Anong, reappears from the bar doors in a modest outfit not far off from what I imagined.

She walks out with another girl, presumably a go-go dancer from inside, and they approach a man who has been waiting for them on the patio. The three of them wave to the mamasan, to which she wishes them well, and then the man raises his elbows for the girls to lock in on each side as they make their way out.

Anong is buoyant, as if it’s her first day of school. Her colleague is a bit more impassive, another day on the job. I watch them stroll through Soi Cowboy until they turn the corner, and it twists my stomach for reasons too profound to make any sense of.

I pull out my phone to write out one last note to remember the night.

This place is not for the sentimental. Not even a fly.

My other essays:

Bangkok
Travel Writing
Red Light District
Thailand
Travel
Recommended from ReadMedium