Skip to content

AWS

  • in AWS, OIDC
  • 4 min read

An AWS IAM Identity Center vulnerability

The short version: AWS IAM Identity Center exchanges third-party OIDC tokens for Identity Center-issued tokens. Identity Center relies on the jti claim in the third-party tokens to prevent replay attacks. Identity Center maintained a cache of previously-seen jti values for a fixed period (24 hours) and didn't enforce that the third-party tokens had expiry claims. This meant that a token with a jti claim and without an exp claim could be replayed after >24 hours had passed. AWS now enforces that these third-party OIDC tokens include an exp claim.

  • in AWS
  • 2 min read

Reversing AWS IAM unique IDs

A few years ago, I wrote about determining AWS account IDs from AWS access keys, i.e. those strings that begin with AKIA or ASIA. It's also possible to determine information from other AWS IAM unique IDs, specifically these two from the table in Amazon's docs.

AWS role session tags for GitHub Actions

Back in 2021, I requested that AWS add some kind of "claim-to-tag mapping" functionality to OIDC IDPs, so that we could have role session tags based on claims in OIDC tokens issued by GitHub Actions. That hasn't happened yet, but today I learned (thanks to this comment and associated blog post by Daniel Jonsén) that the same outcome can be achieved by using AWS Cognito identity pools as an intermediary.

  • in AWS
  • 2 min read

Useful flags for Go Lambda functions

Last week AWS published a blog post advising that the go1.x Lambda runtime will be deprecated and people should migrate to provided.al2. I was already using the newer runtime, but I also learned from the blog post that AWS SAM can now build Go Lambda functions for the newer runtime - no more Makefiles required!

I switched from BuildMethod: makefile to BuildMethod: go1.x and noticed that my Lambda packages were now twice the size. This means slower cold starts and slower deployments - especially from my laptop in Australia. I also noticed that my CI pipelines were slower because every commit was causing Lambda updates, even when no code had changed.

Improve GitHub Actions OIDC security posture with custom issuer

GitHub Actions has supported using OIDC tokens for about 15 months now. It is a much better way of providing AWS credentials to workflows than creating IAM users and storing long-lived access keys in GitHub Actions secrets.

One issue holding back larger organisations from adopting this solution is the lack of useful granular controls. I touched on this in an earlier article AWS IAM OIDC IDPs need more controls.

  • in AWS
  • 4 min read

Centralised logging: from CloudWatch to Kinesis Firehose

AWS CloudWatch Logs supports automatic forwarding of logs to AWS Kinesis Data Streams and AWS Kinesis Data Firehose. These destinations are can even be in a different AWS account and region. This is very handy for aggregating logs from thousands of log groups and forwarding them to a single place, like Axiom, Datadog, Splunk, etc.

  • in AWS
  • 1 min read

Lambda extension environment variables

Here are the environment variables available to an AWS Lambda extension in the provided.al2 runtime. This is really just some context for myself so I don't have to write code to sanity-check myself each time.