avatarGrace Mary Power

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

5791

Abstract

7156">I covered user-specific secrets here:</p><div id="744d" class="link-block"> <a href="https://readmedium.com/create-a-per-user-secret-in-secrets-manager-part-1-bb97b66e2a2d"> <div> <div> <h2>User-Specific Secrets on AWS: IAM Policies</h2> <div><h3>ACM.82 IAM Policies to allow users to describe their own secrets</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*PcniDpBJq2db0jbdryc_Nw.png)"></div> </div> </div> </a> </div><h2 id="aada">Create the user-specific Secret to store the automation credentials</h2><p id="a515">Next I create <b>SandboxDevAutomationSecret</b> in Secrets Manager, encrypted with my <b>Sandbox KMS key</b>.</p><figure id="e15e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*DQonCyF8UzPnZZoiGOKD9w.png"><figcaption></figcaption></figure><figure id="f7b3"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*zITxEtD__wFDwpPrBpqv4w.png"><figcaption></figcaption></figure><h2 id="2e63">Create a user-specific EC2 instance role for the SandboxDev user</h2><p id="3417">Next I create an EC2 instance role that the developer is allowed to pass to EC2 instances named <b>SandboxDevEC2Role</b>.</p><figure id="44ef"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*__fohZeTWjwdYrS__B4imQ.png"><figcaption></figcaption></figure><p id="eee9">The role will have a prefix with the username:</p><figure id="7afa"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*7dKW5KiQMivtKqjgzA_1Gw.png"><figcaption></figcaption></figure><p id="a338">This role is granted access to:</p><ul><li>Read the<b> SandboxDevSecret.</b></li><li>Pull containers from the <b>sandbox Elastic Container Repository.</b></li><li>Use the <b>sandbox KMS key </b>to access decrypt the secret and the container in the repository</li></ul><h2 id="df90">Create the Automation user</h2><p id="b752">Create the <b>SandboxDevAutomation</b> user. Do not give this user console access.</p><figure id="ddeb"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*QWVvQMA9aDCtmiVxSR61iw.png"><figcaption></figcaption></figure><p id="c19e">Remember that I already have a role (<b>CloneGitHubtoCodeCommitRole</b>) used by my batch job from prior posts. Create a policy that allows the SandboxDevAutomation user to use STS to assume that role.</p><p id="559f">The <b>SandboxDev</b> user needs permission to change the <b>credentials</b> <b>and</b> MFA device of the <b>SandboxDevAutomation</b> user.</p><h2 id="0f53">Edit the batch job role trust policy to allow the SandboxDevAutomation role to assume it</h2><p id="7f1d">We need to modify the trust policy to allow the <b>SandboxDevAutomation</b> <b>user</b> to assume the <b>CloneGitHubtoCodeCommitRole</b> role with MFA.</p><figure id="6ad1"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*xAHGslW3SSbv6c5NO8mhzg.png"><figcaption></figcaption></figure><p id="7ad0">Edit the trust policy:</p><figure id="cfaf"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Vna71G_F2e-8Vdtw4yBwFw.png"><figcaption></figcaption></figure><p id="6a5a">Change the user to SandboxDev:</p><figure id="f788"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*vpSqEqjFa_qg59v_dnPCzQ.png"><figcaption></figcaption></figure><h2 id="49b3">Add permissions to KMS Key Resource Policy</h2><p id="8cf1">Next I need to allow the <b>SandboxDev</b> user to encrypt and decrypt and the <b>SanboxDevEC2Role</b> to decrypt with the <b>sandbox KMS Key.</b> I edit my automation to add those two roles to the encrypt and decrypt users.</p><figure id="380f"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*UkzCt10p0iqCR4OpMs6uhQ.png"><figcaption></figcaption></figure><h2 id="d015">Login as SandboxDev</h2><p id="725d">Log into the AWS Console with the SandboxDev user. If you’ve been following along, you have an account with a prefix specific to your organization and -Dev at the end if you used my deployment scripts.</p><figure id="13d5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*5L-3C9ORVXOWv6KRdCkBLg.png"><figcaption></figcaption></figure><h2 id="d260">Add MFA devices</h2><p id="5cca">Add a Hardware MFA device to the SandboxDev User.</p><figure id="21f0"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*8s8rTuyWOsLAQUEqfwTtOQ.png"><figcaption></figcaption></figure><p id="c0e6">Add a Virtual MFA device to the SandboxDevAutomation User.</p><p id="5cec">I explain why I do not use a Yubikey to generate MFA codes here:</p><div id="1308" class="link-block"> <a href="https://readmedium.com/the-yubikey-cli-and-aws-mfa-50e6be0698a7"> <div> <div> <h2>The Yubikey CLI and AWS MFA</h2> <div><h3>ACM.11 Considering the attack surface and MFA choices for our Security Batch Jobs</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*SFAKbcK__GlbJbJJJVXK9w.png)"></div> </div> </div> </a> </div><figure id="5893"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*iFl4DTQNuplt-SGONHpNYw.png"><figcaption></figcaption></figure><h2 id="d7df">Create automation credentials</h2><p id="b9e4">Create an <b>Access key</b> for the <b>SandboxDevAutomation</b> user.</p><figure id="7f1e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*KoVfxp-aJvzBiacPyFeMlA.png"><figcaption></figcap

Options

tion></figure><p id="217e">I have explained before that I disagree with the verbiage on this page. The CLI in the browser has a much larger attack surface and it depends how you are using the keys.</p><figure id="0423"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*_CCe4xu8AcNLloUHgvF5Aw.png"><figcaption></figcaption></figure><h2 id="8caa">Store the credentials in the SandboxDevAutomationSecret</h2><p id="24aa">Head to the Secrets Manager dashboard.</p><p id="432d">Click on the SandboxDevAutomationSecret.</p><figure id="6893"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*cz9jnYSnBsGXf9Y8VZjGPQ.png"><figcaption></figcaption></figure><p id="f616">Store the secret key id and secret access key.</p><figure id="4b95"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*-G9eR929nKSsGWrsOuzucg.png"><figcaption></figcaption></figure><h2 id="5496">Test Launching an EC2 Instance with the SandboxDev role</h2><p id="8907">Head over the EC2 dashboard and test launching an EC2 Instance. Recall that the Instance name needs to match what we specified in the policy above.</p><figure id="a1c7"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*FqCLLp7V854JJZa88TIdvA.png"><figcaption></figcaption></figure><p id="2bc8">If you need to decode any error messages I explained how to do that here:</p><div id="bb13" class="link-block"> <a href="https://readmedium.com/decoding-aws-error-messages-db0e0cbecf0d"> <div> <div> <h2>Decoding AWS Error Messages</h2> <div><h3>Free Content on Jobs in Cybersecurity | Sign up for the Email List</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*4oxP4LXk8l8c3mpRvO7ejg.png)"></div> </div> </div> </a> </div><p id="bd85">Choose the existing networking created for EC2 instances from prior posts.</p><div id="a149" class="link-block"> <a href="https://readmedium.com/automating-cybersecurity-metrics-890dfabb6198"> <div> <div> <h2>Automating Cybersecurity Metrics (ACM)</h2> <div><h3>A series of blog posts on cybersecurity metrics and security automation</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*L9lEIsaWt6xm2Op2ww-G5w.png)"></div> </div> </div> </a> </div><p id="2937">Choose the role we created under Advanced details.</p><figure id="8870"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*oHJior3Ueea6woDB1zqqKQ.png"><figcaption></figcaption></figure><p id="a822">One note that took me a bit to resolve. The message when your user does not have permission to pass the IAM role to the EC2 instance is a bit ambiguous.</p><div id="a0fb" class="link-block"> <a href="https://readmedium.com/ambiguous-error-message-when-a-user-doesnt-have-permission-to-pass-a-specific-iam-role-to-an-ec2-b005f338b6df"> <div> <div> <h2>Ambiguous Error Message When a User Doesn’t Have Permission to Pass a Specific IAM Role to an EC2…</h2> <div><h3>This error message needs to be more specific and doesn’t show up in CloudTrail for the User Name</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*4oxP4LXk8l8c3mpRvO7ejg.png)"></div> </div> </div> </a> </div><p id="51b2">Getting the resources setup took some time because I realized I had to revise my approach. I didn’t automate any of this but I will in the future. For now I just want to make sure it works. I can also figure out what permissions each policy requires.</p><p id="1fb5">I will test the initialization script in the next post.</p><p id="2c31">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="530b"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="eecf"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

What Does Chosen For Distribution On Medium Mean?

Chosen for distribution or curation has changed

Photo by SHVETS production from Pexels

Curation or distribution under Topics has changed in 2021.

Let’s go through some definitions first.

Distribution

Distribution means distributing or sharing a story among a network. It is about displaying or sharing a Medium story for potential readers to find and read.

Curation

Curation means distributing a story under a Topic page, to promote wider reading of the story.

Chosen for distribution

In terms of these words on the Detailed Stats page of your Medium story, it means that your story was chosen to be curated. Don’t confuse the general concept of “chosen for distribution” with this curation function of Medium.

Stories are currently distributed through:

  1. Curation, which means your story is shown on a Topic page.

2. Being shown on a follower’s personalised Medium homepage, whether on a desktop PC or a mobile phone or mobile device.

3. Being shown on the Medium homepages, whether on a desktop PC or a mobile phone or mobile device.

5. Appearing, for readers, under the “Latest ” list under the Tag Names that you have allocated to your stories.

6. Being featured in a “Daily Digest” email or other email sent out by Medium.

7. Being shared on Medium’s Twitter page if your story is in a Medium-run Publication.

8. Being shared on Medium’s Facebook page if your story is in a Medium-run Publication.

9. Being shown on a non-follower’s personalised Medium homepage, whether on a desktop PC or a mobile phone or mobile device.

10. Because of Medium’s excellent S.E.O. (Search Engine Optimisation) your story is picked up by a news aggregator website and shown on those websites, e.g. Muckrack or News360 . [This is not Medium directly distributing stories to these sites, but is included with the meaning of “distribution” given. ]

In addition, the following help to get views/reads of your Medium stories.

  1. Medium finds your self-published story about writing tips and asks you if they can share it (post it) on the Creator’s Hub.
  2. An Editor of a Medium-run Publication finds your self-published story and asks if they can share it (post it) in their publication.

3. You are invited to apply to be a part of a Medium programme, or you apply to be a participant of a programme that is open to anyone to apply, for example, the “Creator Fellowship” programme.

4. Self-promotion or you sharing your Medium stories yourself, and engaging with other Medium writers, who then may engage with you.

5. Publishing say 3 to 5 stories a week on topics / interests / issues that will appeal to the mainstream, at least for your first 6 to 12 months on Medium. After that, “ever-green” or always popular stories, that were published a while ago, may be found and bring in reads.

CURATION

I started reading and writing on Medium in November 2018. In February 2019 the process of manual curation began. Back then it meant that around 25 human curators (according to what Medium stated) read and hand-picked stories to feed under or post under dedicated Topic Pages.

These Topic Pages came under broader Topic Names, for example, “Food” and “Pets” came under CULTURE. There were around 100 Topics (or Topic Pages) that looked like below. “Data Science” came under PROGRAMMING.

Topic Page for “Data Science”. Picture provided by Celine Lai

Since then, Medium stopped sending out emails and having “in-house” or platform Notifications that your story was curated. Currently you can only tell if your story has been “chosen for distribution” i.e. curated, if you go to the Detailed Stats page of your story.

The Detailed Stats page used to include the Topic Name or Names of the Topic Page(s) that your story was curated under, but besides taking away notifcations, in 2020 showing the Topic name(s) was also removed.

And now in 2021 Medium announced on their “3 Min Read” blog that Topics will be replaced by Tags.

When you read the whole article you will find that they refer to “new topic pages”, which has caused confusion among Medium-ites. I assume that the former old Topic names will appear as do Tag Names now, if they weren’t before. Some former Topic names did not exist as Tag Names.

The formerly called Tag Names are now called Topics. Before this change there were TAGS or LABELS and writers could add up to 5 of these to each of their stories. Well, they still can now.

But the difference now is that it is a lot easier and nicer to search for stories under “Tag” names. Beforehand, it was a long-winded process and the Tag Pages didn’t look like what they do now, as this historical article shows.

If you click on any name next to YOUR TOPICS at the top left of your Medium homepage or on any name under Recommended topics at the top right of your Medium homepage, it will take you to the “Tag” Page.

Prior to September 2021 if you clicked on a name in the strip next to YOUR TOPICS it would take you to a dedicated Topic Page, but that no longer happens. If you are interested in my analysis of Medium’s article about the changes, you can find it by clicking HERE . 😄

This month we’re rolling out additional functionality that will allow readers to follow Medium tag pages, which will exponentially expand the number of followable topics. Importantly, tags are replacing topic pages going forward and we will sunset the previous version of Medium topic pages. ← 3 Min Read article from Medium

Curiously, if there are no Topic Pages now, then stories cannot be posted on those Topic Pages! If you go to the former directory or list of Topics and click on any former Topic name, it will take you to the TAG NAME corresponding to the topic.

However, curiouser and curiosest still, some of us are still seeing “Chosen for distribution” on our Detailed Stats story pages!! 😲

For example, I had 2 stories recently curated under Technology and Relationships. I wondered if that meant that Medium had posted them on those Tag Pages, so I had a look at the story titles on those pages. But no, they weren’t there. Also it occurred to me that if my stories had an additional tag then it wouldn’t appear as a Tag Name at the bottom of the stories UNLESS the Medium programme added it.

In the case of my story “How to remove the weather icon from your work computer desktop” I did not select the Tag Name of TECHNOLOGY myself (as you can see for yourself by going to the story). However, quite to my surprise, on the Detailed Stats page I saw the below.

Screenshot provided by Celine Lai.

This information seems to appear and disappear. That is, it appeared temporarily, I assume while Medium is still rolling out or progressing this latest development, related to Topics and Tags!! If you see a similiar screen then the info disappears when you next go to the Stat page, don’t cry, because the Medium programmers are doing their best, trying to work things out.

Big Update: 29 September 2021

I just found out that the labels and info about my stories being “distributed” are because I have the Chrome extension by Martin van Soest installed, haha. Also my friend who is a non-paying member can no longer access Topic pages. It looks like when Tatiana wrote about “Topic pages” (see below) she means the old Tag pages, and the “change” she speaks about is that the writers allocate their stories to these so-called new Topic Pages (formerly Tags) RATHER than Medium puts or curates the stories under dedicated special Topic Pages, like they did. I therefore assume that the “distribution “ in “Chosen for further distribution” on our story Stats pages now simply means Medium possibly showing the story titles on people’s homepages under “Topics” the people are following. And they may distribute the stories in the other ways listed at the top of this article.

I have read the Responses (comments) on Medium’s official article, as shown below, to find Tatiana saying that there was a change to how stories are being sourced onto the topic pages.

Screenshot provided by Celine Lai

I mused over this, wondering if Tatiana meant that now Tags are being called Topics, writers are sort of self-curating by choosing up to 5 tag names for their stories.

Also if readers can now follow millions of Tag Names, how are the stories under their followed Tags going to be presented / given / displayed / shown / fed to the readers? I wrote to Medium asking this question, and the reply was pleasing, saying that they are working on this! So I expect a “feed” of some sort, showing titles of stories under a list of Topic (formerly Tag) names that I’m following.

THEN, it happened!! After staring a lot at Tatiana’s response above, I networked with a friend who has an “account” with Medium, i.e. who is registered by email with Medium, but who is NOT A PAYING MEMBER.

When Medium mentions a “Member” they mean a paying member, but not all those signed up with Medium are “paying members.” I will call those signed up with Medium but not a paid member, a “non-paying member.”

This non-paying member has access to the dedicated Topic Pages.

Medium homepage for a non-paying member. Screenshot provided by Celine Lai

When she clicks on a name next to YOUR TOPICS or under “Recommended topics” it takes her to, what for the paying members, are “former old Topic pages”.

The story titles on her homepage have one label under them each. Some of the labels go to Topic Pages and some go to Tag Pages. But paying members who click on a “label” whether it’s in their feed or next to YOUR TOPICS or under “Recommended topics” are taken to a TAG PAGE (and probably Medium will soon start to refer to TAG PAGES AS TOPIC PAGES in their Help pages).

To my delight, when my accomplice looked at the TECHNOLOGY Topic Page, she found my story title on it. The proof is in the picture below. 😆

Screenshot provided by Celine Lai

And what is the point of all this, you may be asking?

It is that “curation” A.K.A. “distribution (under Topics)” still exists for now. It is in the form of stories being posted on TOPIC PAGES which the passerby and non-paying members or registrants with Medium, who are not paid members, have access to!!

If you log out of your Medium homepage using a browser on a desktop PC, you should see story titles with labels next to them. Try clicking on them and you will probably find that some will go to TAG PAGES and some will go to TOPIC PAGES.

My conclusion and answer to the question WHY this change, is that curation, also known as “distribution under Topic Pages”, may still be maintained in this new mode or way, to encourage non-paying members and the passerby to become paying members!

Medium is still rolling out or progressing the changes, but don’t be surprised to read in an Email from Medium or in their “3 Min Read blog”, an update about how “curation” works!

My guess is that Medium believes writers don’t need to know the specific details of “distribution” or “curation” (partly why they stopped sending out emails about curation); BUT that it will continue ~~ perhaps in Medium’s words to be told to us [ in the near future ] ~~~to mean stories are distributed under Topic Pages for potential new members (in terms of what I have described).

And if you have got this far reading this article, you will see that a label TECHNOLOGY appeared alongside the “Tag” names that I chose for my story “How to remove the weather icon from your work computer desktop.” This is the “Topic Page” that it was distributed/curated under. 😄

The bottom of my article, showing 4 “Tag nanes” that I added myself PLUS a label in black (Technology).

You can read my Follow-up article at the link below:

https://readmedium.com/does-anyone-even-know-what-curation-is-anymore-a07bad24d48

Possibly Useful References

https://help.medium.com/hc/en-us/articles/360006362473-Medium-s-Distribution-Standards-What-Writers-and-Publications-Need-to-Know.

https://help.medium.com/hc/en-us/articles/360018677974.

https://readmedium.com/how-to-work-with-medium-387fcefe17be .

If you liked this article and want to read more, signing up as a member of Medium will mean you can read all stories on Medium (and a portion of your fees will go to me, as well as support others). Click here to become a member!

Medium
Curation
Distribution
Medium Tips
Recommended from ReadMedium