Skip to content

Blog

  • in AWS
  • 2 min read

Cursory AWS KMS research

A couple of months ago, Thai Duong wrote an interesting post about problems with the AWS Encryption SDK. Most of it goes way over my head, but my curiosity was piqued by the mention of reverse-engineering the format of the "ciphertext" returned by KMS Encrypt. There wasn't much detail on that (it wasn't the primary topic) so I thought I'd do some digging into it.

  • in AWS
  • 4 min read

Nitro Enclaves - First Impressions

At the end of October, AWS released Nitro Enclaves. My mental model of these is essentially a secure virtual machine within a virtual machine - the outer VM being an EC2 instance. The secure qualifier is to distinguish that the inner VM has many restrictions: by default it has no network access, no persistent disk, no access to processes running on the host and crucially, vice-versa: the host likewise doesn't have access to resources inside the enclave. All communication instead happens over vsock sockets.

  • in AWS
  • 6 min read

AWS IAM needs aws:ResourceOrgID

Update: In April 2022, AWS released aws:ResourceOrgID (and a couple of other related condition keys). This blog post does a great job of describing how it works. I'll leave the rest of this blog post in place for historical interest, but it's now outdated.

  • in AWS
  • 5 min read

AWS Access Key ID formats

I was thinking about AWS access key IDs yesterday. Specifically, the one that's often in the AWS_ACCESS_KEY_ID environment variable, or aws_access_key_id in ~/.aws/credentials. I was trawling through CloudTrail and the repetitive nature of them caught my eye.

  • in AWS
  • 1 min read

Yet another blog

It's yet another blog. I'm not going to post super often. My Twitter feed is probably more interesting - for a very generous definition of interesting.