E-02 · POST-MORTEM
I built and ran a URL shortener with click analytics on AWS. It worked. But if someone had asked "were you breached?", I couldn't have answered. Here's what I got wrong, what I got right, and what I'd do now.
6 findings from my own review
WHAT HAPPENED
MFA was on, but everything ran through the root user. Root can't be limited by any policy, so one stolen session would have meant losing the whole account.
WHAT I'D DO NOW
Root locked away with MFA and no access keys, used only for billing and recovery. Daily work through IAM Identity Center, and the app on a narrowly scoped role.
WHAT HAPPENED
CloudTrail was never turned on. There was no record of who did what in the account, so a breach would have been invisible.
WHAT I'D DO NOW
CloudTrail in every region and GuardDuty from day one, before the first deploy.
WHAT HAPPENED
I never checked whether security groups, storage buckets or the database were reachable from the internet.
WHAT I'D DO NOW
AWS Config or Security Hub checked against the CIS AWS Foundations Benchmark, plus an external exposure scan. That scan is exactly what my thesis scanner does.
WHAT HAPPENED
Shorteners are a favourite tool for phishing because they hide the destination. And, I didn't have a way to handle abuse reports, so I could have been used to host phishing pages.
WHAT I'D DO NOW
Check every submitted link against Safe Browsing and blocklists, rate-limit link creation, and publish a takedown contact.
.env file was excluded from the start.Switching a service off is a security task too. Leftover resources cost money, and an expired domain lets anyone take over every link you ever issued.
410 Gone so a dead link fails safely.