The new AWS IMDSv2 security feature mitigates common attacks that take advantage of SSRF, open WAFs, and open layer 3 firewalls.
Amazon Web Services will now scan customer environments for potentially misconfigured servers in the wake of Capital One's data breach. Even though many of these cloud-based data breaches weren't the fault of cloud service providers, many are stepping up to detect problems before they become security incidents.
Financial services organizations and many other enterprises have hesitated to go all in the cloud, citing concerns about depending on a third-party to protect the data, and the Capital One breach may encapsulate their fears. But the fact is, the cloud provides security benefits, so long as proper controls are put in place.
A researcher found that some AWS authentication cookies remain valid for up to 12 hours even after a user has changed the password and logged out.
Amazon's AWS cloud platform now has a security feature that will block all public access to S3 data storage buckets.