Hi, I’m Javier — an independent AWS security consultant. I help teams audit their AWS environments, deploy detection pipelines, harden IAM, and prepare for ISO 27001 audits.
This site is where I write about the same work. Practical guides, real audit findings, and the tools I use day to day.
Need hands-on help? Book a free 30-min call →
Security Hub’s new MCP app brings exposure findings into Claude Desktop. Setup, available tools, and practical use cases for compliance triage and remediation prioritization.
Standard GuardDuty analyzes VPC Flow Logs, CloudTrail events, and DNS queries — all metadata about what happened around your workloads. It sees that an EC2 instance connected to a suspicious IP, but it can’t tell you which process made that connection, what command-line arguments it used, or whether it escalated privileges first. Runtime Monitoring changes that. It deploys a lightweight security agent inside your EC2 instances, EKS pods, and ECS tasks that watches operating system events in real time. Process execution, file access, network connections, privilege changes — all visible to GuardDuty without you writing a single detection rule. ...
As of July 2026, AWS Secrets Manager automatically publishes events to Amazon EventBridge whenever a secret value changes. No opt-in, no configuration, no extra cost. This is a significant improvement for anyone monitoring credential rotation or building event-driven security workflows. Before this, detecting secret changes meant parsing CloudTrail logs and correlating multiple API calls (PutSecretValue, UpdateSecretValue, rotation success/failure) — doable but brittle. Now you get a single, clean event on the default EventBridge bus every time a secret changes. ...
GuardDuty and Security Hub show up in almost every AWS security architecture, but they solve fundamentally different problems. GuardDuty watches what’s happening right now — threat detection. Security Hub checks whether your environment is configured correctly — posture management. They overlap in one specific area (findings), which is where the confusion starts. This post breaks down what each service actually does, where they complement each other, and how to set them up together without redundant noise or wasted spend. ...
Walkthrough of a real phishing-initiated endpoint compromise I investigated. Covers the full attack chain from password-protected PDF to PowerShell loader, forensic analysis in an isolated lab, and the response failures that delayed containment.
How to actually use CloudTrail logs day-to-day — tracing non-compliant resources to their source, querying with Athena, and setting up alerts before things go wrong.
SCPs every AWS org should deploy on day one — plus the break-glass pattern, limit gotchas, and why you shouldn’t use SCPs to fix human behavior.
Full breakdown of every permission in the AmazonSSMManagedInstanceCore IAM policy, plus a least-privilege custom alternative for production EC2 instances.
Five real-world AWS incident response scenarios with detection signals, containment steps, CLI commands, and automation examples. Practical guide for security teams.
Five AWS misconfigurations I find in every security audit — with Console and Terraform fixes for public S3 buckets, over-permissive IAM, open security groups, and missing monitoring.
The 30-minute security baseline I run on every AWS account — 10 sections with copy-paste CLI commands covering IAM, S3, CloudTrail, network hardening, and cost monitoring.
10 actionable EKS security best practices covering IRSA, RBAC, network policies, pod security standards, image scanning, secrets encryption, and node hardening.
Stop using IAM users in AWS. This guide explains why they’re risky and how to migrate to Identity Center, STS, and OIDC-based access — step-by-step.
How to map, audit, and automate CIS Benchmark compliance for EC2 instances using AWS Config, Security Hub, SSM, and open-source scanners.
Practical EKS security checklist — control plane audit logs, Falco runtime detection, GuardDuty for containers, and the monitoring gaps most teams miss.
If your background is cloud security and you’re thinking about breaking into pentesting, the eJPTv2 is a solid entry point. I prepared for it coming from years of AWS security work — hardening infrastructure, responding to incidents, writing detection rules — and found the study process both natural and surprisingly humbling. This post covers how I prepared, what resources were worth the time, and how a defender’s background actually helps (and where it blinds you). ...
Deep dive into IDOR vulnerabilities with real AWS API examples, bug bounty cases, and prevention strategies for Lambda, API Gateway, and internal tooling.
Enable GuardDuty, filter noisy findings by severity, and wire EventBridge alerts to Slack or your SIEM — with Terraform and Console steps.
Set up AWS-native detection for privilege escalation using CloudTrail, EventBridge, and minimal infrastructure. Real API patterns and alerting included.
Step-by-step guide to build a hardened Amazon Linux 2 AMI with EC2 Image Builder including CIS benchmarks, IMDSv2 enforcement, auditd, and logging configuration.