Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-database-2-7명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SOC 직업 분류 기준
SKILL.md 표시 중
| name | cis-aws-database-2.7 |
| description | Ensure Least Privilege Access |
| category | cis-database |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","database","aurora","least-privilege","iam","polp","access-control"] |
| cis_id | 2.7 |
| cis_benchmark | CIS AWS Database Services Benchmark v2.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-database-2.4","cis-aws-database-2.10"] |
| prerequisites | [] |
| severity_boost | {} |
Use the principle of least privilege when granting access to your Amazon Aurora resources. This principle of least privilege (POLP) is a computer security concept where users are given the minimum access levels necessary to complete their job functions.
In Amazon Aurora, this can be implemented at various levels, including AWS IAM for managing AWS resources and within the database for managing database users and roles.
Here is a step-by-step guide for each:
POLP limits the user interaction on the database, and it only gives the database permission to complete the necessary or mandatory task. AWS IAM gives permission for what the entity can and cannot do. Incorporating both POLP and AWS IAM in a database gives limited permission to the user to complete the tasks.
Users would need to create a IAM role to implement POLP into their database.
Sign in to AWS Management Console
Navigate to IAM Dashboard
Security, Identity, & Compliance category.Create a new IAM role or user
Roles or Users.Create role or Create user.Attach minimum necessary permissions
Log into your Aurora Database
Create a new user
For example:
CREATE USER '<username>'@'<localhost>' IDENTIFIED BY 'password';
For example:
GRANT SELECT, INSERT ON <mydb.mytbl> TO '<username>'@'<localhost>';
SHOW GRANTS FOR '<username>'@'<localhost>';
This is important because it reduces and secures any possible threat that an unauthorized user can gain by hacking into the system.
Follow the audit procedure steps above to implement least privilege access at both the AWS IAM level and within the Aurora database.
By default, newly created IAM users have no permissions. Database master users created during Aurora cluster setup have full administrative privileges.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists - Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. | x | x | x |
| v7 | 14.6 Protect Information through Access Control Lists - Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities. | x | x | x |
Level 1 | Manual