Security
12 posts tagged Security.
The CloudFront prefix list proves a request came from CloudFront, not from your CloudFront
A security group rule on the managed prefix list admits every CloudFront origin-facing server on earth, including the ones serving someone else's distribution pointed at your origin. AWS's own guidance puts a secret header first and the prefix list as an optional extra, the list costs 55 of your 60 rules, and VPC origins replace both with a service-managed security group that is scoped to your distributions and nothing else.
Networking7 minStop and start an instance and one of its four addresses changes, which is the one in the firewall
Private IPv4, IPv6 and an Elastic IP all survive a stop and start. The auto-assigned public IPv4 does not: it is released on stop and a new one is assigned on start, and the old one can never be recovered. Associate an Elastic IP later and the public address is released then too. Every address costs the same $0.005 an hour, so the one that changes is the one with no reason to exist.
Networking6 minAn S3 endpoint policy that names only your buckets breaks dnf and docker pull
Amazon Linux package repositories and ECR image layers are S3 objects in buckets AWS owns. Lock a gateway endpoint policy down to your own buckets and both stop working, with an access-denied that names a bucket you have never heard of. The policy language has three more traps, and the default policy is the only one that cannot hit them.
Networking7 minA DNS Firewall allowlist blocks the name you allowed, because the CNAME behind it was never on the list
Route 53 Resolver DNS Firewall inspects every name in a redirection chain by default. Allow app.example.com, and the query is still blocked when that record is a CNAME to a CDN hostname the list does not mention. The default fail mode is closed, the block response can be made to look like a missing record, and the fix is one setting whose two values mean opposite things.
Networking9 minA stale security group rule allows nothing, until the peering it was written for comes back
Delete a peering connection, a transit gateway, or a referenced security group and every rule that pointed at it goes stale. Stale rules are not removed; they sit in the group admitting no one. Peer the same two VPCs again for an unrelated reason and the rule is no longer stale. There are four ways a rule gets there, one command that finds them, and one command to run before you delete anything.
Networking8 minTen kinds of traffic VPC Flow Logs never record
A flow log with no REJECT lines is routinely read as proof that nothing was blocked. AWS documents ten categories of traffic that flow logs exclude by design, and several of them are precisely the traffic you would be looking for when something is wrong.
Networking6 minClient VPN connected, authenticated, and reaching nothing
A Client VPN endpoint has its own route table and its own authorization rules, and a destination has to be in both before a connected user can reach it. Add one without the other and the tunnel is up, the client has an address, and every packet goes nowhere — with a different silence depending on which one you forgot.
Networking6 minThe network failures that present as success
Most AWS networking incidents announce themselves with a timeout. A smaller set return a valid answer and do the wrong thing, and every diagnostic instinct that works on the first kind has nothing to grab on the second.
Networking5 minYou can route around the local route, and that is how intra-VPC inspection works
"The local route always wins and cannot be overridden" is the version most people learn. It is wrong twice: a route more specific than the VPC CIDR wins by longest prefix match, and the local route's target can be replaced outright. The first is what makes inspecting traffic between two subnets possible.
Networking5 minSecurity group referencing across a Transit Gateway needs two flags, not one
It has to be enabled on the transit gateway and on every VPC attachment. Enable it in one place and it does nothing, with no error. The limitation list is also longer than most people check.
Networking5 minAppliance mode has a prerequisite that silently undoes it
Enable appliance mode and forget route propagation on the associated Transit Gateway route table, and every flow falls back to hash-based Availability Zone selection. The attachment still reports appliance mode enabled.
Networking8 min"The ephemeral port range" means four different things
Network ACLs get written with 32768-65535 because that is the number everyone knows. It is nobody's actual range — it is AWS's example. A NAT Gateway uses 1024-65535, and the gap between the two is an intermittent failure that retries hide for weeks.
Networking6 min