Amazon Web Services

Red Education names AWS among the leading brands it works with in its award submissions and delivers AWS coursework alongside its security-vendor portfolio, extending the same instructor-led, lab-driven format to cloud fundamentals and architecture.

AWS began inside Amazon as infrastructure plumbing and was opened to the world in 2006; within a decade it was the profit engine of its parent and the default substrate for startups and enterprises alike. Every SASE, SSE, and cloud-security curriculum in the rest of this catalogue ultimately assumes a world AWS created.

Two incidents describe what it means for one supplier to hold this much of the world's computing, and the company's own account of the first is the better source for it. On the morning of 28 February 2017 an engineer in the Northern Virginia region, following an established playbook, ran a command meant to remove a few servers from a billing subsystem. One input was mistyped. The servers removed included the ones holding the index of every object in the region's storage, and the restart that followed took S3 down - and with it instance launches, block storage and Lambda for everything that depended on that region, which at the time was much of the consumer internet. A typo reached further than most attacks ever have, and the reason was not the typo but the concentration.

The second is the 2019 Capital One breach, and it is the case where the vendor's design was part of the answer. A former AWS employee found a request-forgery flaw in a misconfigured web firewall running on EC2, and used it to ask the instance's metadata service for credentials. The service, in its original form, answered any request from the machine without authentication - by design. The credentials belonged to a role that could read hundreds of storage buckets, and more than a hundred million customer records left. It ran for four months and was found because the attacker posted about it and a stranger noticed.

The shared-responsibility model says, correctly, that the customer misconfigured the firewall and over-permissioned the role. It is also true that four months later AWS shipped a second version of the metadata service requiring a session token first - a change that only exists because the first design made the flaw lethal. A senator asked the company's chief executive whether its own services had contributed, which is the question the model is written to pre-empt, being asked anyway.

The afterlife of that fix is the recurring part. The hardened metadata service is optional; years on, a large share of instances still run the original. The Siemens entry describes a fix that cannot reach the installed base because the equipment cannot be changed. Here the equipment can be changed in one setting, and is not, because the default was never moved - and a fix that requires every customer to opt in is, at scale, a fix that half of them do not have.

None of this argues against the platform. It argues that when a supplier becomes the substrate for everything else, a mistyped command and an unauthenticated endpoint stop being that supplier's problems and become everybody's, and that the responsibility model which sounds like a division of labour is, in practice, a description of whose failures land on whom.