Jean-Pierre J juljeanpierre

Disable Amazon S3 SSE-C Encryption

When using `SSE-C encryption` the key is generated and stored outside your AWS Account (client-side). So if IAM accessKeys were compromised and the keys are associated with permissions to S3, the user could encrypt with SSE-C and hold the data ransom with the encryption key in their possession.

`Image generated with ChatGPT.`

This RCP contains a statement to DENY/BLOCK the use of SSE-C Encryption on objects in Amazon S3 buckets within your organization.

How to customize Verification code emails in Amazon Cognito? Using Lambda!

You can create a lambda function that intercepts Cognito Sync Trigger in order to override the message.

Problem:

If you have e-mail verification enabled in Cognito which in most cases you should have the user copies the received verification code from the e-mail in-order to paste it in your app. This is the same for when a user uses the ForgotPassword feature. The problem is that the e-mails sent from Cognito by default is sent in PLANETEXT.

Enforce MFA for getSigninToken on AWS

Enabling Custom Identity Broker Access to the AWS Console

You can write and run code to create a URL that lets users who sign in to your organization's network securely access the AWS Management Console. The URL includes a sign-in token that you get from AWS and that authenticates the user to AWS.

Example Code [Python]

How to setup your own CA with OpenSSL

For educational reasons I've decided to create my own CA. Here is what I learned.

First things first

Lets get some context first.

	import os
	import urllib.request
	import re
	from bs4 import BeautifulSoup

	# regEx to extract IP, SBL, Date & Time
	IPregex = r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
	SBLregex = r'\w{3}\d{6}'
	DTregex = r'\d{1,2}\-\w{3}\-\d{4} \d{2}\:\d{2} \w{3}'

	import requests
	import sys
	import socket
	from ipwhois import IPWhois
	from pprint import pprint
	from datetime import datetime
	from tld import get_fld
	from tld.utils import update_tld_names
	update_tld_names()

Jean-Pierre J juljeanpierre

Disable Amazon S3 SSE-C Encryption

When using SSE-C encryption the key is generated and stored outside your AWS Account (client-side). So if IAM accessKeys were compromised and the keys are associated with permissions to S3, the user could encrypt with SSE-C and hold the data ransom with the encryption key in their possession.

Image generated with ChatGPT.

This RCP contains a statement to DENY/BLOCK the use of SSE-C Encryption on objects in Amazon S3 buckets within your organization.

How to customize Verification code emails in Amazon Cognito? Using Lambda!

Problem:

Enforce MFA for getSigninToken on AWS

Enabling Custom Identity Broker Access to the AWS Console

Example Code [Python]

Table of Contents

How to setup your own CA with OpenSSL

First things first

When using `SSE-C encryption` the key is generated and stored outside your AWS Account (client-side). So if IAM accessKeys were compromised and the keys are associated with permissions to S3, the user could encrypt with SSE-C and hold the data ransom with the encryption key in their possession.

`Image generated with ChatGPT.`