Let's build an bullet proof instance on AWS - Security Play Ground (letsbuild S05e01)
Channel: tecRacer AWS-Channel
Date: 30/09/2020

Analyse the capital one data breach. 
Enhance security with IMDSV2, caller based security and least privileges.


00:00 Introduction
05:30 DevBizSecOps vs Evil Hacker dogs
06:30 Stealing credentials
09:45 The instance metadata service
11:45 Create the battleground vpc with the cdk
15:00 Automatically create a security group limited to outgoing dynamic IP
19:00 configure a local AWS IAM user "jessica"
28:45 Connect easily to instance with EC2 instance connect
31:45 Stealing EC2 credentials
33:45 Using the stolen credentials locally
39:00 Protecting instance with caller based policy
43:45 Create a construct for enabling IMDSv2 with CDK
56:00 Testing the bulletproof instance

Blog post defenders: https://aws-blog.de/2019/10/defenders-caller-based-ec2-security-with-cdk.html
Blog post imdsv2 https://aws-blog.de/2020/01/three-hurdles-to-skip-before-using-the-secure-instance-metadata-service-v2.html
Blog Post CDK Custom Constructs: https://aws-blog.de/2020/06/bridging-the-terraform-cloudformation-gap.html