Hacker News Reader

Comment by the_arun | Hacker News Reader

1. Isn't this a gap in the platform? I mean, shouldn't AWS automate this and alert (via AWS Config Rules/AWS Security Hub OR AWS Trusted Advisor) owners of these mis-configured resources?

2. Even better, should aws let customers proceed if they have mis-configurations?

View on HN

#1 probably. #2 no. AWS is not responsible for how you setup your resources. They are very clear about that unless you use proserve or something. They are not your IT dept even for managed services.

Policing their customers' configurations would open them up for liability and embarrass them and their customers. But they do provide a ton of tools for customers to investigate their own security.

AWS basically rents digital chainsaws. You hope they know how to use it, but you know a fair number probably don't.

That sounds like an excellent subscription plan, I'm sure they sell those services already.

Of course Amazon assumes that you know what you're doing, so it won't include such scans by default. If you set up a container to be world accessible, you're probably intending to do so, otherwise you wouldn't expose it like that.

If you're unsure, you can always pay extra to have Amazon verify such things for you, but they're not your IT infra manager and neither should they be.

AWS very much assumes you know what you're doing. Products like CloudConformity exist to let you know when you're probably misconfiguring something.

AWS has a product called Security Hub. There's a rule which will alert for any RDS instances open to the internet:

https://docs.aws.amazon.com/securityhub/latest/userguide/sec...

SecurityHub will notify you if you launch the managed ES service outside a VPC. It’s still your responsibility to ensure that there is no ingress from the internet to the associated subnets.

If you’re launching EC2 and installing ES on it, you’re probably going to have to create your own Config rules for auditing.

Reply on news.ycombinator.com