AWS Lambda has supported function versions since October 2015, only
a couple of months after the service itself was publicly launched. Versions are
an optional feature - you can develop and use Lambda functions without versioning,
in which case you are working with the implicit $LATEST version.
A couple of months ago, Thai Duong wrote an interesting post about
problems with the AWS Encryption SDK. Most of it goes way over my head, but my
curiosity was piqued by the mention of reverse-engineering the format of the
"ciphertext" returned by KMS Encrypt. There wasn't much detail on
that (it wasn't the primary topic) so I thought I'd do some digging into it.
At the end of October, AWS released Nitro Enclaves. My mental model of these is essentially a secure virtual machine within a virtual machine - the outer VM being an EC2 instance. The secure qualifier is to distinguish that the inner VM has many restrictions: by default it has no network access, no persistent disk, no access to processes running on the host and crucially, vice-versa: the host likewise doesn't have access to resources inside the enclave. All communication instead happens over vsock sockets.
Update: In April 2022, AWS released aws:ResourceOrgID (and a couple of other related
condition keys). This blog post does a great job of describing
how it works. I'll leave the rest of this blog post in place for historical
interest, but it's now outdated.
I was thinking about AWS access key IDs yesterday. Specifically, the one that's
often in the AWS_ACCESS_KEY_ID environment variable, or aws_access_key_id
in ~/.aws/credentials. I was trawling through CloudTrail and the repetitive
nature of them caught my eye.
It's yet another blog. I'm not going to post super often. My Twitter feed is probably more interesting - for a very generous definition of interesting.
Security September: Cataclysms in the Cloud Formations was a guest post on Ian Mckay's blog.
Security September: Escaping CodeBuild - The compromise that wasn't was a guest post on Ian Mckay's blog.