kmcquade

• chime:CreateApiKey
• codepipeline:PollForJobs
• cognito-identity:GetOpenIdToken
• cognito-identity:GetOpenIdTokenForDeveloperIdentity
• cognito-identity:GetCredentialsForIdentity
• connect:GetFederationToken
• connect:GetFederationTokens
• ecr:GetAuthorizationToken
• [gamelift:RequestUploadCredentials](ht

kmcquade

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": "ec2:RunInstances",
            "Resource": "arn:aws:ec2:*::image/ami-*",
            "Condition": {
                "StringNotEquals": {

kmcquade

aws organizations attach-policy \
  --policy-id $(aws organizations create-policy --name pwn \
     --type SERVICE_CONTROL_POLICY \
     --description "pwn" 
     --content '{"Version": "2012-10-17","Statement": [{"Effect": "Deny", "Action": "*", "Resource": "*"}]}' \
    | jq ".Policy.PolicySummary.Id"\
    ) \
  --target-id $(aws organizations list-roots | jq ".Roots | .[0].Id")

noamsdahan

iann0036

acm-pca:CreateCertificateAuthority
aws-marketplace:AcceptAgreementApprovalRequest
aws-marketplace:Subscribe
backup:PutBackupVaultLockConfiguration
bedrock:CreateProvisionedModelThroughput
bedrock:UpdateProvisionedModelThroughput
devicefarm:PurchaseOffering
dynamodb:PurchaseReservedCapacityOfferings
ec2:ModifyReservedInstances
ec2:PurchaseCapacityBlock

z0ph

#!/bin/bash

# From Victor (zoph) Grenu from zoph.io - https://zoph.io
# Twitter: @zoph

TARGET_ROLE_NAME="AdministratorAccess"

## Get list of AWS accounts using SSO
AWS_ACCESS_TOKEN=$(cat $(ls -1d ~/.aws/sso/cache/* | grep -v botocore) | jq -r "{accessToken} | .[]")
ACCOUNTS_IDS=($(aws sso list-accounts --access-token $AWS_ACCESS_TOKEN | jq -r '.accountList[] | .accountId'))

hashbrowncipher

One time at work, my team was upgrading an open source search-engine-cum-database that had an unfortunate predilection for breaking its external API. We had already deployed the new version of the database with its breaking changes, and now it was time to herd our customers off of the old version and onto the new version. Our customers were naturally reticent: for most of them it was just a bunch of work for very little reward. The migration would require careful testing, and just generally it didn't sound like a fun time. To top the situation off, some of these customers' services hadn't been touched in years, and the original authors had long since left.

I'm proud to say that my team was significantly more interested in accommodating our customers' needs than some other DBA teams I've worked with or around. During the migration we spent a fair bit of time chewing on ways to lessen the burden we placed on our customers. At one point the possibility of simply "handing off" the outdated search engines was dis

houey

Talks and blog posts that all newcomers should check out when interested in Cloud Security

Bringing a machete to the amazon (Peterson)
https://youtu.be/y8nftRzbiXk

Flying a false flag: (Landers)
https://youtu.be/2BEwqbCbQuM

Another day another billion packets (Brandwine)
https://youtu.be/3qln2u1Vr2E

jchrisfarris

#!/bin/bash

ROLENAME=$1

if [ -z $ROLENAME ] ; then
  echo "usage $0 <ROLENAME>"
  exit 1
fi

while read line ; do

badideasforsale

#!/bin/bash

# Get role name, git org or user, and git repo
# If not set, error out later
# @TODO: add help text
# @TODO: verify org/repo are not wildcards

while getopts ":r:o:g:h" opt; do
  case $opt in
    r) ROLE_NAME="$OPTARG"