Krzysztof Wilczyński kwilczynski

Defensive (Hardening, Security Assessment, Inventory)

ScoutSuite: https://github.com/nccgroup/ScoutSuite - Multi-Cloud Security auditing tool for AWS, Google Cloud and Azure environments (Python)
Prowler: https://github.com/toniblyx/prowler - CIS benchmarks and additional checks for security best practices in AWS (Shell Script)
CloudSploit: https://github.com/cloudsploit/scans - AWS security scanning checks (NodeJS)
CloudMapper: https://github.com/duo-labs/cloudmapper - helps you analyze your AWS environments (Python)
CloudTracker: https://github.com/duo-labs/cloudtracker - helps you find over-privileged IAM users and roles by comparing CloudTrail logs with current IAM policies (Python)
AWS Security Benchmarks: [https://github.com/awslabs/aws-security-benchmark](ht

Installation

did brew install pulumi, installed 1.0.0 , running it keeps nagging about brew upgrade to 1.0.1
I wonder if there is a phone-home option, then it needs an optional opt-out
I'd expect pulumi init instead of new
pulumi needs documentation on the bootstrap for the state bucket (correct permissions)
pulumi login defaults to the saas platform, and says alternative logins available. not too clear , a select local would be nice
also the path where is stores the files should be asked for during installation
pulumi new --secrets-provider=passphrase (default I assume) has no way to initialize the secret from the CLI (like reading it from stdin or file)
why is bin in .gitignore (because typescript compiles in ./bin)

Kubernetes Master Nodes Backup for Kops on AWS - A step-by-step Guide

For those who have been using kops for a while should know the upgrade from 1.11 to 1.12 poses a greater risk, as it will upgrade etcd2 to etcd3.

Since this upgrade is disruptive to the control plane (master nodes), although brief, it's still something we take very seriously because nearly all the Buffer production services are running on this single cluster. We felt a more thorough backup process than the currently implemented Heptio Velero was needed.

To my surprises, my Google searches didn't yield any useful result on how to carry out the backup steps. To be fair, there are a few articles that are specifically for backing up master nodes created by kubeedm but nothing too concrete for `kop

$ go doc -all net/http | awk '$1 ~ /Status/ && $2 == "=" {print}' | awk '{print $3, $1}'
100 StatusContinue
101 StatusSwitchingProtocols
102 StatusProcessing
200 StatusOK
201 StatusCreated
202 StatusAccepted
203 StatusNonAuthoritativeInfo
204 StatusNoContent

	  krzysztof@rocinante  ~  $ irb
	irb(main):001:0> cis1 = 0x0000001
	=> 1
	irb(main):002:0> cis2 = 0x0000002
	=> 2
	irb(main):003:0> ubuntu = 0x0000010
	=> 16
	irb(main):004:0> centos = 0x0000020
	=> 32
	irb(main):005:0> amazon = 0x0000040

	#!/bin/bash

	FILES=$@

	echo "Migrate: $FILES"

	sed -i "s/errors.Wrapf(\(.\), \"\(.\)\", \(.*\))/fmt.Errorf(\"\2: %w\", \3, \1)/g" $FILES
	sed -i "s/errors.Wrap(\(.\), \"\(.\)\")/fmt.Errorf(\"\2: %w\", \1)/g" $FILES
	sed -i "s/errors.Errorf/fmt.Errorf/g" $FILES
	goimports -w .

	#define PFATAL(x...) \
	do { \
	fprintf(stderr, "[-] SYSTEM ERROR : " x); \
	fprintf(stderr, "\n\tLocation : %s(), %s:%u\n", __FUNCTION__, __FILE__, \
	__LINE__); \
	perror(" OS message "); \
	fprintf(stderr, "\n"); \
	exit(EXIT_FAILURE); \
	} while (0)

	#!/bin/bash -ex

	# Build a new Centos8 install on EBS volume in a chroot
	# Run from RHEL8 or CentOS8 instance - eg: ami-0c322300a1dd5dc79 in us-east-1 (RHEL 8 official image)
	# Script expects a second EBS volume, I add them as /dev/sdf in the console
	# When the script completes, turn the second EBS volume into your new AMI through the console.

	# Adjust the section below to match the device names you're using. Defaults are for an m5.large

	# m5 series requires the updated device names

	// \
	/*
	#include <stdio.h>
	int main() {
	printf("Hello, World from C!\n");
	return 0;
	}

	#if 0
	//*/

	package main

	import (
	"fmt"
	"reflect"
	"time"
	)

	func Filter(slice interface{}, filter interface{}) interface{} {
	if slice == nil {