Steps to Use AMIs in a Secure Manner – AWS Security Fundamentals – SCS-C02 Study Guide

Steps to Use AMIs in a Secure Manner

If you look in AWS Marketplace or even search from the EC2 Launch page, you will see that there are lots of AMIs to choose from. Many of these AMIs are provided by community members or third-party providers. How are you to know that the AMI that you are about to launch in your environment doesn’t have a back door embedded inside of it for the creator to gain access to your network? The following are some steps you can take to use these types of AMIs in a more secure manner:

  1. The first step, especially if you are working in a corporate or enterprise environment, is to test the AMI in a sandbox environment so that you, as a security engineer, can examine the AMI and run any necessary scans for malware or crypto miners on it before launching it in your primary working environments.
  2. Next, you want to see if there are any previously stored public SSH keys on the image. If there are, you can disable or delete them. Not all keys will be stored in the /root/.ssh/authorized_keys file. Instead, use the following command to find any keys located on the image (run this command as the root user: sudo su):

find / -name “authorized_keys” -print -exec cat {} \;

This command should locate and print to screen any found on the image. If any appear that you don’t recognize, you can remove them and create a new AMI image.

As an extra precaution with an image you have obtained from public sources, don’t allow SSH access (port 22) from any IP address (0.0.0.0/0) in your security groups. Have a tightened list of IP ranges that are allowed access to prevent outside access.

  • The next thing to look for when using a public or community AMI is stored usernames and passwords. This is another way that someone could gain access to the instance and your network. Use the following command to help you find usernames and passwords that are stored on the AMI:

cat /etc/passwd /etc/shadow | grep -E ‘^[^:]*:[^:]{3.}’ | cut -d: -f1

If there is any output from the script, such as usernames you don’t recognize, you can use the password command (still as the root user) to change the password or use the userdel command to delete the user.

Note

The scripts and steps presented here are for your information as you work as a security professional. Knowing the exact steps to sweep an AMI for planted keys is not a skill that’s tested in the AWS Certified Security Specialty certification exam.

The next section will talk about how to configure EC2 instances automatically with the use of user data scripts.