Welcome to The Hidden Port

Walkthrough of a real phishing-initiated endpoint compromise I investigated. Covers the full attack chain from password-protected PDF to PowerShell loader, forensic analysis in an isolated lab, and the response failures that delayed containment.

How to actually use CloudTrail logs day-to-day — tracing non-compliant resources to their source, querying with Athena, and setting up alerts before things go wrong.

SCPs every AWS org should deploy on day one — plus the break-glass pattern, limit gotchas, and why you shouldn’t use SCPs to fix human behavior.

Full breakdown of every permission in the AmazonSSMManagedInstanceCore IAM policy, plus a least-privilege custom alternative for production EC2 instances.

Five real-world AWS incident response scenarios with detection signals, containment steps, CLI commands, and automation examples. Practical guide for security teams.

Five AWS misconfigurations I find in every security audit — with Console and Terraform fixes for public S3 buckets, over-permissive IAM, open security groups, and missing monitoring.

A 30-minute security review for your AWS account — 30+ controls covering IAM hardening, S3 lockdown, logging, and budget alerts. Built for small teams.

10 actionable EKS security best practices covering IAM integration, RBAC, network policies, pod security, image scanning, secrets management, and node hardening.

Stop using IAM users in AWS. This guide explains why they’re risky and how to migrate to Identity Center, STS, and OIDC-based access — step-by-step.

How to map, audit, and automate CIS Benchmark compliance for EC2 instances using AWS Config, Security Hub, SSM, and open-source scanners.

Practical EKS security checklist — control plane audit logs, Falco runtime detection, GuardDuty for containers, and the monitoring gaps most teams miss.

If your background is cloud security and you’re thinking about breaking into pentesting, the eJPTv2 is a solid entry point. I took it coming from years of AWS security work — hardening infrastructure, responding to incidents, writing detection rules — and found the transition both natural and surprisingly humbling. This post covers how I prepared, what resources were worth the time, and how a defender’s background actually helps (and where it blinds you). ...

Deep dive into IDOR vulnerabilities with real AWS API examples, bug bounty cases, and prevention strategies for Lambda, API Gateway, and internal tooling.

Set up GuardDuty in 10 minutes, route findings to Slack or your SIEM via EventBridge, and learn which finding types actually matter.

Set up AWS-native detection for privilege escalation using CloudTrail, EventBridge, and minimal infrastructure. Real API patterns and alerting included.

Step-by-step guide to build a hardened Amazon Linux 2 AMI with EC2 Image Builder including CIS benchmarks, IMDSv2 enforcement, auditd, and logging configuration.

How to audit and refine IAM permissions using Access Analyzer, CloudTrail, and service access history — enforcing least privilege the right way in AWS.

Complete SSM Session Manager setup — AmazonSSMManagedInstanceCore policy, IAM roles, and replacing SSH with zero open ports.

This guide delves into the technical aspects of hardening EC2 instances, covering topics from instance selection to monitoring and automation, aligning with AWS’s security recommendations.

After publishing my free AWS IR checklist, I decided to go one step further — a full incident response toolkit with Terraform code, automation scripts, and ready-to-use templates. Here’s what’s inside.