Back to Details

aws-security-review

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

AWS Security Review

AWS 安全审查

A structured audit of an AWS account or organization.
对 AWS 账户或组织进行结构化审计。

1. IAM Deep Dive

1. IAM 深入分析

  • Enumerate users, roles, policies (identity + resource + permission boundaries)
  • Hunt privilege escalation paths: 
    iam:CreatePolicyVersion
    , 
    iam:PassRole
    + 
    ec2:RunInstances
    /lambda creation, 
    sts:AssumeRole
    chains, 
    iam:SetDefaultPolicyVersion
  • Wildcard actions/resources on trust boundaries; 
    NotAction
    with 
    Effect: Allow
    traps
  • Unused credentials, access keys older than 90 days, no rotation
  • Check trust policies: roles assumable by 
    *
    or by external account IDs
  • 枚举用户、角色、策略（identity + resource + permission boundary）
  • 排查权限提升路径：
    iam:CreatePolicyVersion
    、
    iam:PassRole
    + 
    ec2:RunInstances
    /Lambda 创建、
    sts:AssumeRole
    链、
    iam:SetDefaultPolicyVersion
  • 信任边界上的通配符 action/resource；使用 
    Effect: Allow
    的 
    NotAction
    陷阱
  • 未使用的凭据、超过 90 天未轮换的 access key
  • 检查 trust policy：可由 
    *
    或外部账户 ID 扮演的角色

Tools

工具

  • scoutSuite
    , 
    prowler
    , 
    pmapper
    (privilege escalation graph), 
    cloudsplaining
    (least-privilege diffs)
  • scoutSuite
    、
    prowler
    、
    pmapper
    （权限提升图谱）、
    cloudsplaining
    （最小权限差异分析）

2. Exposure Review

2. 暴露面审查

  • S3: public buckets/block public access at account level; ACLs vs bucket policy conflicts
  • EBS/RDS/redshift snapshots: shared or public
  • Load balancers/security groups: 
    0.0.0.0/0
    on management ports (22/3389), database ports exposed
  • API Gateway, Lambda function URLs, Elasticsearch/OpenSearch domains with open access policies
  • S3：公共 bucket/账户级 block public access；ACL 与 bucket policy 冲突
  • EBS/RDS/Redshift 快照：共享或公开
  • Load Balancer/security group：管理端口（22/3389）允许 
    0.0.0.0/0
    ，数据库端口暴露
  • API Gateway、Lambda function URL、Elasticsearch/OpenSearch domain 配置了开放访问策略

3. Encryption and Data

3. 加密与数据

  • Default encryption on S3/EBS/RDS; KMS key policies scoped correctly
  • Secrets Manager vs hardcoded values in env vars committed to IaC
  • CloudTrail: multi-region, log file validation, no public bucket; GuardDuty enabled
  • S3/EBS/RDS 启用 default encryption；KMS key policy 的作用域配置正确
  • Secrets Manager 与提交至 IaC 的环境变量中硬编码值的对比检查
  • CloudTrail：多区域、日志文件验证、无公共 bucket；启用 GuardDuty

4. Network

4. 网络

  • VPC flow logs on; NAT gateway vs IGW placement for private subnets
  • Peering/transit gateway routes leaking ranges
  • Public subnets hosting workloads that should be private
  • 启用 VPC flow log；检查 private subnet 中 NAT gateway 与 IGW 的部署位置
  • Peering/transit gateway 路由泄露地址范围
  • Public subnet 承载本应为 private 的 workload

5. Workload Identity

5. Workload Identity

  • EC2 instance profiles over long-lived keys; EKS IRSA / pod identity
  • Tasks/containers without privileged modes; metadata service v2 enforced
  • 使用 EC2 instance profile 代替长期有效的 key；EKS IRSA/pod identity
  • 未以 privileged mode 运行的 task/container；强制使用 metadata service v2

Output

输出

Ranked findings: exposure (public data/ports), privilege escalation chains (with 
pmapper
-style path evidence), logging gaps, and remediation mapped to specific policy/resource ARNs.
按风险排序的发现：暴露面（公共数据/端口）、权限提升链（附带 
pmapper
风格的路径证据）、日志记录缺口，以及映射到具体 policy/resource ARN 的修复建议。