Husband, father, AWS principal engineer, BYU grad, and fan of typefaces, dinosaurs, movies, & comics. Member of the Church of Jesus Christ of Latter-day Saints.
@0xdabbad00 By default, GetDataAccess will provide you with credentials based on the most specific grant matching the requested S3 target location, but will give you credentials with all that grant's access to minimize the total number of distinct credentials to juggle.
๐๏ธ Exciting News! ๐
We're thrilled to announce our latest breakthrough: a seamless integration between the @Immuta Data Security Platform and Amazon Web Services (@AWSCloud) S3 Access Grants.
Learn more: ๐https://t.co/owhoT3Ja1n
#AWSreInvent#DataSecurity@AWS_Partners
This but for all the new AWS announcements I'm trying to cram into my brain. ๐ญ I'm sorry if I see you at re:Invent and forgot your name. I had to make room for S3 Access Grants.
I won't post socially here, but I can still shill:
Looking forward to presenting chalk talk STG324 on Advanced Security Patterns for S3 at re:Invent next week. Come learn about S3 policies, token vending machines, DMZs, and more! #aws#Reinvent
๐ We've launched 2 new condition keys to scalably allow AWS services to access your resources only on your behalf
๐ aws:SourceOrgId
๐ aws:SourceOrgPaths
Learn more to get started ๐ https://t.co/aYZDhAY5Cs
It's disappointing to see this from AWS, the company that's famously API-first and famously bad at 1st party UIs, and that has not delivered a significant improvement in session catalog UX in the 8 years I've been going to re:Invent
I'm sad to share that AWS is reaching out to all third-party Re:Invent session trackers with a takedown notice. I have no choice but to comply.
It wouldn't be so bad if the official catalog had a better UX. I'm especially going to miss @RaphaelManke's calendar browser.
He gave us confidence that things would be treated seriously, investigated, and resolved in a timely manner and through coordination across the massive organization that is Amazon. He does so professionally and with grace, even when we turn out to be wrong in our assumptions.
Dan Urson has been the voice of AWS security to many of us. He's the person external researchers interact with when they find issues (or think they find issues) with AWS. Any team would be lucky to have him.
https://t.co/Uf3WZbzx8u
Amazon S3 now applies two security best practices to all new buckets by default
Amazon S3 now applies two new default bucket security settings by automatically enabling S3 Block Public Access and disabling S3 access control lists (ACLs) for all new... https://t.co/fjSlf07oJg
S3 at rest encryption by default and soon it'll be non-trivial to make an S3 bucket public because Public Block access will be applied by default in April. We also got multiple MFAs for the root and the root email no longer tied to the underpants account. Thank you AWS folks!
Starting in April 2023, #Amazon S3 will introduce two new default bucket security settings by automatically enabling S3 Block Public Access & disabling access control lists (ACLs) for all new S3 buckets. ๐ defaults are recommended security best practices: https://t.co/9tfb7zxiDP
Breaking my no-Twitter streak to promote this blog post: changing default S3 bucket behavior to align with best practices! This is a big deal! https://t.co/h2vjxXt1Oy
Uninstalling Twitter tonight. Not a Mastodon fan so I guess it's time to start a proper blog. I'll have time enough, now, assuming I actually manage to quit doomscrolling cold turkey. Peace.
Writing a post and I was quite proud of myself for this line: "If you think Mastodon solves human nature because itโs open source and decentralized, you havenโt spent enough time on the Linux kernel mailing list." ๐