Manish S. Saindane

at the bottom right of the postbox

"Collisions in the cryptographic hash functions are extremely unlikely to happen"?

1

MD5 and SHA-1 are affected by collisions. Probably modify this sentence. You do cover this under "Secure Hash Algorithms", so the above statement somehow contradicts. Reference: https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html

AWS Lambda limits the number of concurrent executions of your Lambda functions that can be running at a given time (default: 1000 within a given region).  This could lead to...

S3 - Attacker gains access to insecurely configured S3 bucket via brute forcing the bucket name

4

S3 bucket names are unique. If S3 buckets are public, but some files within them are private, they can be viewed in the dir listing (but cannot be accessed). Attackers...

IAM - Failed login attempts go un-noticed

2

CloudTrail is not enabled by default. Unsuccessful login attempts will not be logged unless CloudTrail is enabled. NOTE: unsuccessful sign-in events by the root user are not logged by CloudTrail....

IAM - Attacker having knowledge of unused access keys can compromise the infrastructure

3

Threat: Spoofing Mitigations: * Disable or delete access keys that have not been used for a long time. References: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html

IAM - Attacker having knowledge of unused passwords can compromise the infrastructure

1

Threat: Spoofing Mitigations: * Disable or delete accounts with passwords unused for a long time. References: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html

S3 - Attacker can recover sensitive information from a previous version of a file stored.

3

By default, on a versioned S3 bucket, AWS does not delete previous versions of the file automatically. Threat: Information Disclosure Mitigations could include: * Remove all versions of sensitive files...

If there are double quotes, it does not use the '.rsense' file and thus does not load the paths on Windows.