HashiCorp Supports AWS Lambda Extensions for Serverless Security

HashiCorp has recently announced the public preview of the HashiCorp Vault AWS Lambda Extension. The new service is based on the recently launched AWS Lambda Extensions API and allows a serverless application to securely retrieve secrets from HashiCorp Vault without making the Lambda functions Vault-aware.

The extension reads secrets from HashiCorp Vault and writes them to disk before the AWS Lambda function starts. It authenticates using AWS IAM, relying on the same identity the Lambda function is running. As the Runtime API and the Extensions API are independent endpoints, the new approach makes the external security approach transparent to the Lambda function itself.

Source: https://aws.amazon.com/blogs/compute/introducing-aws-lambda-extensions-in-preview

The Vault AWS Lambda Extension can retrieve different secrets from Vault and writes the JSON response from HashiCorp Vault to the configured destination. It is available in the HashiCorp GitHub repo, that includes examples with the Amazon ARN to be referenced in the Lambda function.

“This is going to make a lot of folks’ lives a lot easier” predicts Lucy Davinhart, senior automation engineer at Sky Betting & Gaming. Andrey Devyatkin, DevSecOps consultant, explains the main benefit of the new approach:

This is neat. Before you would have to read secrets via Terraform and pass them via environment variables which didn’t work well with dynamic secrets. I wonder if extension will be able to keep leases renewed.

#serverless #cloud #aws #developer

What is GEEK

Buddha Community

9 AWS Security Best Practices: Securing Your AWS Cloud

Working with Amazon facilities, it is necessary to implement AWS security best practices to ensure the safety of the data and the cloud.

The digitalization drive has become the dominating trend, with computer technologies penetrating all spheres of social and personal life in the modern world. Alongside ushering innumerable benefits, the ubiquitous advent of IT devices has brought serious concerns in its wake. One of the most pressing questions that worries both individuals and organizations is, “How secure is my virtual data?”

Public anxiety is continuously fed by reports of security breaches and data leakages that cost companies a pretty penny. Their  financial losses manifest an ever-growing pattern, with businesses having to spend (or waste?) millions of dollars to redress gruesome consequences. For example, Desjardines Group lost over $50 million to cover for the data leakage of their clientele, and Norsk Hydro had to fork out $75 million to eliminate the effects of a cyberattack. Such exorbitant losses are rare, but  IBM experts believe that on average, corporate victims of cybercrime have to foot a bill equal to $4 million. Because of such appalling statistics, establishing cybersecurity of their IT environment is prioritized by many organizations. Even the malicious onslaught of the global pandemic didn’t relegate security considerations to a secondary place, with companies reluctant to cut down on the security strategy enforcement expenditures.

AWS Security Best Practices

Start With Planning

Know Thy Ground

Don’t Neglect Native Resources

Make Your Security Policy Comprehensive

Implement User Access Control

Define Password Policy

Make Data Encryption a Rule

Remember to Backup Your Data Regularly

Systematic Security Policies Updates and Open Access is a Must

#security #aws #serverless #cloud security #aws security

50+ Useful Kubernetes Tools for 2020 - Part 2

Introduction

Last year, we provided a list of Kubernetes tools that proved so popular we have decided to curate another list of some useful additions for working with the platform—among which are many tools that we personally use here at Caylent. Check out the original tools list here in case you missed it.

According to a recent survey done by Stackrox, the dominance Kubernetes enjoys in the market continues to be reinforced, with 86% of respondents using it for container orchestration.

(State of Kubernetes and Container Security, 2020)

And as you can see below, more and more companies are jumping into containerization for their apps. If you’re among them, here are some tools to aid you going forward as Kubernetes continues its rapid growth.

(State of Kubernetes and Container Security, 2020)

#blog #tools #amazon elastic kubernetes service #application security #aws kms #botkube #caylent #cli #container monitoring #container orchestration tools #container security #containers #continuous delivery #continuous deployment #continuous integration #contour #developers #development #developments #draft #eksctl #firewall #gcp #github #harbor #helm #helm charts #helm-2to3 #helm-aws-secret-plugin #helm-docs #helm-operator-get-started #helm-secrets #iam #json #k-rail #k3s #k3sup #k8s #keel.sh #keycloak #kiali #kiam #klum #knative #krew #ksniff #kube #kube-prod-runtime #kube-ps1 #kube-scan #kube-state-metrics #kube2iam #kubeapps #kubebuilder #kubeconfig #kubectl #kubectl-aws-secrets #kubefwd #kubernetes #kubernetes command line tool #kubernetes configuration #kubernetes deployment #kubernetes in development #kubernetes in production #kubernetes ingress #kubernetes interfaces #kubernetes monitoring #kubernetes networking #kubernetes observability #kubernetes plugins #kubernetes secrets #kubernetes security #kubernetes security best practices #kubernetes security vendors #kubernetes service discovery #kubernetic #kubesec #kubeterminal #kubeval #kudo #kuma #microsoft azure key vault #mozilla sops #octant #octarine #open source #palo alto kubernetes security #permission-manager #pgp #rafay #rakess #rancher #rook #secrets operations #serverless function #service mesh #shell-operator #snyk #snyk container #sonobuoy #strongdm #tcpdump #tenkai #testing #tigera #tilt #vert.x #wireshark #yaml

Adding Code to AWS Lambda, Lambda Layers, and Lambda Extensions Using Docker

2020 was a difficult year for all of us, and it was no different for engineering teams. Many software releases were postponed, and the industry slowed its development speed quite a bit.

But at least at AWS, some teams released updates out of the door at the end of the year. AWS Lambda received two significant improvements:

• AWS Lambda Extensions; and
• Support of Docker images for your functions.

With these two new features and Lambda Layers, we now have three ways to add code to Lambda that isn’t directly part of our Lambda function.

The question is now: when should we use what?

In this article, I try to shine some light on the Lambda Layers, Lambda Extensions, and Docker image for Lambda.

First things first. All these Lambda features can be used together. So if you think about where to put your code, at least your decisions aren’t mutually exclusive. You can upload a Docker image and attach a regular Lambda Layer and a Lambda Extension. The same is possible if your Lambda function is based on a ZIP archive.

What does this all mean? Keep reading and find out.

#aws #aws-lambda #serverless #devops #docker #lambda

How To Unite AWS KMS with Serverless Application Model (SAM)

The Basics

AWS KMS is a Key Management Service that let you create Cryptographic keys that you can use to encrypt and decrypt data and also other keys. You can read more about it here.

Important points about Keys

Please note that the customer master keys(CMK) generated can only be used to encrypt small amount of data like passwords, RSA key. You can use AWS KMS CMKs to generate, encrypt, and decrypt data keys. However, AWS KMS does not store, manage, or track your data keys, or perform cryptographic operations with data keys.

You must use and manage data keys outside of AWS KMS. KMS API uses AWS KMS CMK in the encryption operations and they cannot accept more than 4 KB (4096 bytes) of data. To encrypt application data, use the server-side encryption features of an AWS service, or a client-side encryption library, such as the AWS Encryption SDK or the Amazon S3 encryption client.

Scenario

We want to create signup and login forms for a website.

Passwords should be encrypted and stored in DynamoDB database.

What do we need?

1. KMS key to encrypt and decrypt data
2. DynamoDB table to store password.
3. Lambda functions & APIs to process Login and Sign up forms.
4. Sign up/ Login forms in HTML.

Lets Implement it as Serverless Application Model (SAM)!

Lets first create the Key that we will use to encrypt and decrypt password.

KmsKey:
    Type: AWS::KMS::Key
    Properties: 
      Description: CMK for encrypting and decrypting
      KeyPolicy:
        Version: '2012-10-17'
        Id: key-default-1
        Statement:
        - Sid: Enable IAM User Permissions
          Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
          Action: kms:*
          Resource: '*'
        - Sid: Allow administration of the key
          Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${AWS::AccountId}:user/${KeyAdmin}
          Action:
          - kms:Create*
          - kms:Describe*
          - kms:Enable*
          - kms:List*
          - kms:Put*
          - kms:Update*
          - kms:Revoke*
          - kms:Disable*
          - kms:Get*
          - kms:Delete*
          - kms:ScheduleKeyDeletion
          - kms:CancelKeyDeletion
          Resource: '*'
        - Sid: Allow use of the key
          Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${AWS::AccountId}:user/${KeyUser}
          Action:
          - kms:DescribeKey
          - kms:Encrypt
          - kms:Decrypt
          - kms:ReEncrypt*
          - kms:GenerateDataKey
          - kms:GenerateDataKeyWithoutPlaintext
          Resource: '*'

The important thing in above snippet is the KeyPolicy. KMS requires a Key Administrator and Key User. As a best practice your Key Administrator and Key User should be 2 separate user in your Organisation. We are allowing all permissions to the root users.

So if your key Administrator leaves the organisation, the root user will be able to delete this key. As you can see **KeyAdmin **can manage the key but not use it and KeyUser can only use the key. ${KeyAdmin} and **${KeyUser} **are parameters in the SAM template.

You would be asked to provide values for these parameters during SAM Deploy.

#aws #serverless #aws-sam #aws-key-management-service #aws-certification #aws-api-gateway #tutorial-for-beginners #aws-blogs

AWS Lambda Vs EC2 | Serverless Vs EC2 | EC2 Alternatives

In this video we are going to learn the differences between ec2 vs lambda by going over:

1. What is Serverless and what is EC2
2. Environment, Use Case difference between lambda and ec2
3. Learn how differently EC2 and Lambda scale
4. Do Cost comparison lambda vs ec2 for couple cases
5. Finally we are going to look at some EC2 alternatives and end with parting words.

#aws #lambda #ec2 #serverless #aws lambda