Hardening AWS Environments and Automating Incident Response for AWS Compromises
summary
Demos a usable toolkit that actually disables compromised IAM keys, snapshots volumes, quarantines instances with a deny‑egress security group and streams live RAM into S3. The release includes awsi (one‑command case creation and inventory across all regions), Margarita shotgun (SSH‑based memory capture with prebuilt kernel modules and multipart S3 upload for parallel acquisition) and threat prep (configuration checks for S3, CloudTrail, IAM and VPC flow logs). Live demos show the tools working end‑to‑end and the code is available.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:31Risks in AWS environments
- 3:27Attack vectors
- 6:14Incident response phases
- 7:31Built-in AWS security tools
- 11:02Orchestration and roles
- 13:55Compliance with AWS config
- 16:50Identity and access auditing
- 19:42Introducing the AWSI tool
- 25:06Remote memory acquisition
- 28:56Threat response workstation
- 36:09Proactive environment hardening
- 39:11Community and future outlook
related talks
47mBringing a Machete to the Amazon
26mAWS (mis)configuration from an attacker’s-eye view
40mBringing a Machete to the Amazon
46mAttacking AWS: The Full Cyber Kill Chain
39mPerils of the cloud
33mAutomating Cloud Security and Incident Response (DevSecOps)
43mThink like a HACKER
37mLocking Down the Security of IAM