article thumbnail

Setup keyless authentication to Google Cloud for GitHub Actions using Terraform

Xebia

When a GitHub Actions workflow needs to read or mutate resources on Google Cloud it must first authenticate to the platform. Not only does this cause a security risk for leaking this key, but it might also be that the creation of this key is blocked by your organization’s policy.

article thumbnail

How to: Deploy Terraform to AWS with GitHub Actions authenticated with OpenID Connect

Xebia

This poses a security risk because most of the time these AWS credentials are long-lived credentials with a lot of permissions. In the past it was very common to use AWS credentials (access token and secret) in your GitHub actions pipeline. If these credentials get leaked or misused the damage done could be huge.

AWS 130
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

ApatchMe - Authenticated Stored XSS Vulnerability in AWS and GCP Apache Airflow Services

Tenable

Unpatched Apache Airflow instances used in Amazon Web Services (AWS) and Google Cloud Platform (GCP) allow an exploitable stored XSS through the task instance details page. The web panel image versions offered by these two cloud providers were all vulnerable to CVE-2023-29247. GCP is working on releasing a new, updated version.

article thumbnail

Akeyless secures a cash infusion to help companies manage their passwords, certificates and keys

TechCrunch

Back in 2018, Refael Angel, a former security software engineer at Intuit, had an idea for a new approach to protect encryption keys — the random string of bits created to scramble and unscramble data — on the cloud. GitGuardian estimates that app security engineers on average have to handle over 3,400 secrets occurrences.

Company 217
article thumbnail

AWS vs. Azure vs. Google Cloud: Comparing Cloud Platforms

Kaseya

In this blog, we’ll compare the three leading public cloud providers, namely Amazon Web Services (AWS), Microsoft Azure and Google Cloud. A subsidiary of Amazon, AWS was launched in 2006 and offers on-demand cloud computing services on a metered, pay-as-you-go basis. Greater Security. Security Limitations.

article thumbnail

Cybersecurity Snapshot: SANS Offers Tips for Maximizing Smaller OT Security Budgets

Tenable

A SANS Institute survey found that budgets for ICS/OT security have shrunk, and advises on how to do more with less. In addition, CISA’s Cybersecurity Awareness Month campaign challenges tech vendors to build safer products. For more information about ICS/OT security, check out these Tenable blogs and videos: “ Three U.S.

Budget 65
article thumbnail

Cybersecurity Snapshot: Discover the Most Valuable Cyber Skills, Key Cloud Security Trends and Cyber’s Big Business Impact

Tenable

Learn all about the cybersecurity expertise that employers value most; Google Cybersecurity Action Team’s latest take on cloud security trends; a Deloitte report on cybersecurity’s growing business influence; a growth forecast for cyber spending; and more! Happy New Year! Market value increase: 5.3% .

Trends 98