avatarBrooke Ramey Nelson

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

5791

Abstract

7156">I covered user-specific secrets here:</p><div id="744d" class="link-block"> <a href="https://readmedium.com/create-a-per-user-secret-in-secrets-manager-part-1-bb97b66e2a2d"> <div> <div> <h2>User-Specific Secrets on AWS: IAM Policies</h2> <div><h3>ACM.82 IAM Policies to allow users to describe their own secrets</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*PcniDpBJq2db0jbdryc_Nw.png)"></div> </div> </div> </a> </div><h2 id="aada">Create the user-specific Secret to store the automation credentials</h2><p id="a515">Next I create <b>SandboxDevAutomationSecret</b> in Secrets Manager, encrypted with my <b>Sandbox KMS key</b>.</p><figure id="e15e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*DQonCyF8UzPnZZoiGOKD9w.png"><figcaption></figcaption></figure><figure id="f7b3"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*zITxEtD__wFDwpPrBpqv4w.png"><figcaption></figcaption></figure><h2 id="2e63">Create a user-specific EC2 instance role for the SandboxDev user</h2><p id="3417">Next I create an EC2 instance role that the developer is allowed to pass to EC2 instances named <b>SandboxDevEC2Role</b>.</p><figure id="44ef"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*__fohZeTWjwdYrS__B4imQ.png"><figcaption></figcaption></figure><p id="eee9">The role will have a prefix with the username:</p><figure id="7afa"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*7dKW5KiQMivtKqjgzA_1Gw.png"><figcaption></figcaption></figure><p id="a338">This role is granted access to:</p><ul><li>Read the<b> SandboxDevSecret.</b></li><li>Pull containers from the <b>sandbox Elastic Container Repository.</b></li><li>Use the <b>sandbox KMS key </b>to access decrypt the secret and the container in the repository</li></ul><h2 id="df90">Create the Automation user</h2><p id="b752">Create the <b>SandboxDevAutomation</b> user. Do not give this user console access.</p><figure id="ddeb"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*QWVvQMA9aDCtmiVxSR61iw.png"><figcaption></figcaption></figure><p id="c19e">Remember that I already have a role (<b>CloneGitHubtoCodeCommitRole</b>) used by my batch job from prior posts. Create a policy that allows the SandboxDevAutomation user to use STS to assume that role.</p><p id="559f">The <b>SandboxDev</b> user needs permission to change the <b>credentials</b> <b>and</b> MFA device of the <b>SandboxDevAutomation</b> user.</p><h2 id="0f53">Edit the batch job role trust policy to allow the SandboxDevAutomation role to assume it</h2><p id="7f1d">We need to modify the trust policy to allow the <b>SandboxDevAutomation</b> <b>user</b> to assume the <b>CloneGitHubtoCodeCommitRole</b> role with MFA.</p><figure id="6ad1"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*xAHGslW3SSbv6c5NO8mhzg.png"><figcaption></figcaption></figure><p id="7ad0">Edit the trust policy:</p><figure id="cfaf"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Vna71G_F2e-8Vdtw4yBwFw.png"><figcaption></figcaption></figure><p id="6a5a">Change the user to SandboxDev:</p><figure id="f788"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*vpSqEqjFa_qg59v_dnPCzQ.png"><figcaption></figcaption></figure><h2 id="49b3">Add permissions to KMS Key Resource Policy</h2><p id="8cf1">Next I need to allow the <b>SandboxDev</b> user to encrypt and decrypt and the <b>SanboxDevEC2Role</b> to decrypt with the <b>sandbox KMS Key.</b> I edit my automation to add those two roles to the encrypt and decrypt users.</p><figure id="380f"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*UkzCt10p0iqCR4OpMs6uhQ.png"><figcaption></figcaption></figure><h2 id="d015">Login as SandboxDev</h2><p id="725d">Log into the AWS Console with the SandboxDev user. If you’ve been following along, you have an account with a prefix specific to your organization and -Dev at the end if you used my deployment scripts.</p><figure id="13d5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*5L-3C9ORVXOWv6KRdCkBLg.png"><figcaption></figcaption></figure><h2 id="d260">Add MFA devices</h2><p id="5cca">Add a Hardware MFA device to the SandboxDev User.</p><figure id="21f0"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*8s8rTuyWOsLAQUEqfwTtOQ.png"><figcaption></figcaption></figure><p id="c0e6">Add a Virtual MFA device to the SandboxDevAutomation User.</p><p id="5cec">I explain why I do not use a Yubikey to generate MFA codes here:</p><div id="1308" class="link-block"> <a href="https://readmedium.com/the-yubikey-cli-and-aws-mfa-50e6be0698a7"> <div> <div> <h2>The Yubikey CLI and AWS MFA</h2> <div><h3>ACM.11 Considering the attack surface and MFA choices for our Security Batch Jobs</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*SFAKbcK__GlbJbJJJVXK9w.png)"></div> </div> </div> </a> </div><figure id="5893"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*iFl4DTQNuplt-SGONHpNYw.png"><figcaption></figcaption></figure><h2 id="d7df">Create automation credentials</h2><p id="b9e4">Create an <b>Access key</b> for the <b>SandboxDevAutomation</b> user.</p><figure id="7f1e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*KoVfxp-aJvzBiacPyFeMlA.png"><figcaption></figcap

Options

tion></figure><p id="217e">I have explained before that I disagree with the verbiage on this page. The CLI in the browser has a much larger attack surface and it depends how you are using the keys.</p><figure id="0423"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*_CCe4xu8AcNLloUHgvF5Aw.png"><figcaption></figcaption></figure><h2 id="8caa">Store the credentials in the SandboxDevAutomationSecret</h2><p id="24aa">Head to the Secrets Manager dashboard.</p><p id="432d">Click on the SandboxDevAutomationSecret.</p><figure id="6893"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*cz9jnYSnBsGXf9Y8VZjGPQ.png"><figcaption></figcaption></figure><p id="f616">Store the secret key id and secret access key.</p><figure id="4b95"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*-G9eR929nKSsGWrsOuzucg.png"><figcaption></figcaption></figure><h2 id="5496">Test Launching an EC2 Instance with the SandboxDev role</h2><p id="8907">Head over the EC2 dashboard and test launching an EC2 Instance. Recall that the Instance name needs to match what we specified in the policy above.</p><figure id="a1c7"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*FqCLLp7V854JJZa88TIdvA.png"><figcaption></figcaption></figure><p id="2bc8">If you need to decode any error messages I explained how to do that here:</p><div id="bb13" class="link-block"> <a href="https://readmedium.com/decoding-aws-error-messages-db0e0cbecf0d"> <div> <div> <h2>Decoding AWS Error Messages</h2> <div><h3>Free Content on Jobs in Cybersecurity | Sign up for the Email List</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*4oxP4LXk8l8c3mpRvO7ejg.png)"></div> </div> </div> </a> </div><p id="bd85">Choose the existing networking created for EC2 instances from prior posts.</p><div id="a149" class="link-block"> <a href="https://readmedium.com/automating-cybersecurity-metrics-890dfabb6198"> <div> <div> <h2>Automating Cybersecurity Metrics (ACM)</h2> <div><h3>A series of blog posts on cybersecurity metrics and security automation</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*L9lEIsaWt6xm2Op2ww-G5w.png)"></div> </div> </div> </a> </div><p id="2937">Choose the role we created under Advanced details.</p><figure id="8870"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*oHJior3Ueea6woDB1zqqKQ.png"><figcaption></figcaption></figure><p id="a822">One note that took me a bit to resolve. The message when your user does not have permission to pass the IAM role to the EC2 instance is a bit ambiguous.</p><div id="a0fb" class="link-block"> <a href="https://readmedium.com/ambiguous-error-message-when-a-user-doesnt-have-permission-to-pass-a-specific-iam-role-to-an-ec2-b005f338b6df"> <div> <div> <h2>Ambiguous Error Message When a User Doesn’t Have Permission to Pass a Specific IAM Role to an EC2…</h2> <div><h3>This error message needs to be more specific and doesn’t show up in CloudTrail for the User Name</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*4oxP4LXk8l8c3mpRvO7ejg.png)"></div> </div> </div> </a> </div><p id="51b2">Getting the resources setup took some time because I realized I had to revise my approach. I didn’t automate any of this but I will in the future. For now I just want to make sure it works. I can also figure out what permissions each policy requires.</p><p id="1fb5">I will test the initialization script in the next post.</p><p id="2c31">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="530b"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="eecf"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

INVESTIGATIVE “JOURNALISM”

Woodward & Bernstein Slept Here

And everyone wanted a seat at the table

Author’s Archives.

Follow me back to 1974, or so. Seriously.

No, I wasn’t there when Old Plaid was born, but I can imagine it all too well.

Furniture Designer: Have you seen the new line of leisure suits that Sears is promoting? A sort of rustic rose and barf-green plaid combo.

Furniture Executive: Yes! The pattern kinda reminds me of Daisy Duke’s shirt. You know, the girly plaid one she knots right under her ta-tas.

Furniture Designer: Exactly! Maybe we could coin some of that sexual innuendo in a furniture covering? I’m thinking family room couches — we could start calling them “sofas” again. Hearkens back to the far-out ’50s with a tinge of not-too-far-out-there feminism.

Furniture Executive: You mean like a colorful plaid permutation? Groovy!

And that’s how Old Plaid came into the picture.

I’m told he was an “impulse buy” for a principal some years back. Dude in Charge had a little extra cash in his slush fund (all administrators have slush funds — you know that, right?) He had a chance to purchase new English textbooks and chose instead to up his interior decorator’s game, or something. With a hideous rustic rose and barf-green plaid couch.

Men.

This wild family furnishing actually recycled itself down to Room 215.

On its journey to my classroom, this sad sack of a “groovy” ’70s sofa had been in the principal’s office, his administrative assistant’s alcove, the main office, and an off-the-beaten-path locale known as the “Faculty Dining Room.”

Of course, the plaid davenport didn’t cushion the derrieres of many teachers as they dined. Funds supporting a separate place for us to recharge and replenish were soon moved back to the principal’s slush fund — probably so he could redecorate again.

Twenty years or so after his initial conception, Old Plaid took on a sorta existential existence —helping to rest the rumps of hundreds of teenage scribes.

And you can bet those kids of the ’90s and early aughts knew how to turn a once peerless piece of plaid pulchritude into a grubby refuge of rebellion.

Or, at least hang out in the choice location to take a load off.

Anyone who knows a teenager can guess where this story is headed.

Let me explain.

I spent more than two decades marshalling my teenage forces in favor of scholastic journalism. The kids had a certain amount of freedom that normal high-schoolers just don’t possess.

They did their fair amount — in the pages of our student newspaper and yearbook — of investigating, ruminating about, and skewering various folks “in charge,” like that dude at our school. The kids relished their assignments — and, I’m proud to say, earned quite a bit of hard-fought-for recognition over the years.

But, as we all know, all work and no play makes Jack & Jill, well, boring.

So they spent a lot of “down time” in the computer lab adjoining my classroom — which, for some reason, they called the “Bat Cave.” And they termed their gregarious teen socializing “Kumbaya.”

Over the years, kids of the high school persuasion sat on that damn couch til a number of predictable things happened to it.

  • The left arm fell off one day after five or so of my charges perched on it. Yes, they tried to re-anchor the appendage. In fact, one young lady had her dad come in with his power tools. But alas, repair efforts were for naught, and I made the executive decision that a one-armed sofa was better than none, so we carried on.
  • Holes of varying sizes started appearing in the putrid plaid. This just meant the students — being an average of 15 years old — just made those gaps larger, by digging pens and pencils and rulers and at one point someone’s Size 13 soccer cleat — into Old Plaid’s orifices and then pulling the cushion stuffing out.
  • One young man deserved props, at least, for trying to patch the sad plaid. One afternoon he went home after school and picked up his big sister’s sewing basket. She apparently had taken a quilting class in college, and possessed a bag of scraps, too. So Sammy Homemaker made a valiant effort with bright blue fabric to contain some of the damage. Let’s just say his efforts pretty much failed, spectacularly.
  • Two recent Journalism Program grads — who had matriculated to well-known colleges — came back to visit with an iron and some adhesive-backed photos. This resulted in an unsuccessful attempt to adhere snaps from back in the day to the surface of Old Plaid. Which also meant short-circuiting the power in the English Department wing. No lights, no computer, no more school, at least for the day.
  • A series of cryptic messages — some in the form of protest signs — started cropping up on the file cabinets behind Old Plaid. “I am a couch. I have feelings,” read one of my faves. “Please do not: cut me; tear me; molest my stuffing; tattoo me; sit on me if you are quite smelly. Thank You!”

Of course, Old Plaid eventually suffered the ultimate indignity.

I was lounging around on said sofa one morning during my break. Grading timed essays, I think. Well, that’s a pretty great guess, because as an English teacher, I was always grading.

I paused after plowing through one particularly dense piece of prose. Glanced down, beyond where the Old Plaid’s left arm was supposed to be.

And saw vermin droppings.

Eeeeeeeeeekkkkkkk!!!

I couldn’t tell if a rat or just a lil old field rodent had left his calling card, but I was up off that couch faster than a cat chasing a you-know-what.

“Yup, you’ve got mice,” the building superintendent said, after I’d fled the entire length of the building to his office and begged him to take a look-see at the tell-tale calling card.

“Yikes! How do you know?” Lots of gasps. I was exhausted from the sprint and fearful of the outcome of his investigation.

“Well, you’ve got the scat,” he pointed out. Professional lingo for mouse poop. “And I dug around in the springs, too.”

“What did you find?” I was surprised Old Plaid still had springs. And pretty pessimistic about the professional diagnosis.

“Oh, you’ve got a nest in there.” Great, what does that mean? “I’d say at least two mice. But you’re lucky — they look to be little, by the way they set up housekeeping.”

My students christened the small visitors — which we never saw, I should add — Woodward & Bernstein.

I have to say I was — briefly — proud of my kids’ ability to remember reportorial history. But accumulated knowledge aside, they continued to sit, aimlessly farting around for the rest of the spring semester. I, meanwhile, never again got near Old Plaid — nor the Bat Cave, really — again.

Bad things, of course, come to couches who harbor interlopers. And, natch, a high price must be paid.

I was desperate by the end of May to give the old heave-ho to Old Plaid. But he was a three-seater. And built in the ’70s, before manufacturers started skimping on materials. Pretty heavy, dude.

I talked to the building manager, who said I could get the couch out to the hallway, he’d have someone haul it away. So I paid two football players to take care of the dirty deed for me.

And because we’re talking teens here, you know Old Plaid had a much softer landing than that.

It was gone the next day when I came in to work. But the custodial staff hadn’t had time to get to it. A theater student — who’d been running lines for her final exam out in the hallway near Room 215 after school — said a well-known cabal of potheads co-opted the couch and transported it to someone’s nearby basement.

It was only a matter of time before someone’s mom discovered the detritus and demanded it be removed.

Poor Old Plaid. He didn’t even get a proper disposal.

The last I saw him a few weeks later, he was straddling the grassy median in front of the school —getting drenched in a summer monsoon.

I have no clue what happened to Woodward & Bernstein. The mice, not the investigative reporters. But I’m told they’re intrepid examiners of American angst. They probably found another place to nest.

Education
Journalism
This Happened To Me
Humor
Teens
Recommended from ReadMedium