Cloud Security

The patterns that actually make AI agents in AWS dangerous — and the guardrails I run when giving Claude access to my own AWS accounts.

AWS IAM Identity Center now supports new organization instances without account access management enabled — no more service-linked role in every member account. When to use it, when to skip it, and the migration considerations for existing instances.

The four AWS evidence categories ISO 27001 auditors actually ask for, from someone who’s prepared environments for a real audit. Custom evidence collection, common gaps, and where teams get caught off guard.

How to use IAM permission boundaries to sandbox developers in AWS — with the sandbox pattern I deploy for clients, the mental model people get wrong, and when to reach for boundaries instead of SCPs.

Security Hub’s new MCP app brings exposure findings into Claude Desktop. Setup, available tools, and practical use cases for compliance triage and remediation prioritization.

Standard GuardDuty analyzes VPC Flow Logs, CloudTrail events, and DNS queries — all metadata about what happened around your workloads. It sees that an EC2 instance connected to a suspicious IP, but it can’t tell you which process made that connection, what command-line arguments it used, or whether it escalated privileges first. Runtime Monitoring changes that. It deploys a lightweight security agent inside your EC2 instances, EKS pods, and ECS tasks that watches operating system events in real time. Process execution, file access, network connections, privilege changes — all visible to GuardDuty without you writing a single detection rule. ...

As of July 2026, AWS Secrets Manager automatically publishes events to Amazon EventBridge whenever a secret value changes. No opt-in, no configuration, no extra cost. This is a significant improvement for anyone monitoring credential rotation or building event-driven security workflows. Before this, detecting secret changes meant parsing CloudTrail logs and correlating multiple API calls (PutSecretValue, UpdateSecretValue, rotation success/failure) — doable but brittle. Now you get a single, clean event on the default EventBridge bus every time a secret changes. ...

GuardDuty and Security Hub show up in almost every AWS security architecture, but they solve fundamentally different problems. GuardDuty watches what’s happening right now — threat detection. Security Hub checks whether your environment is configured correctly — posture management. They overlap in one specific area (findings), which is where the confusion starts. This post breaks down what each service actually does, where they complement each other, and how to set them up together without redundant noise or wasted spend. ...

Walkthrough of a real phishing-initiated endpoint compromise I investigated. Covers the full attack chain from password-protected PDF to PowerShell loader, forensic analysis in an isolated lab, and the response failures that delayed containment.

How to actually use CloudTrail logs day-to-day — tracing non-compliant resources to their source, querying with Athena, and setting up alerts before things go wrong.

SCPs every AWS org should deploy on day one — plus the break-glass pattern, limit gotchas, and why you shouldn’t use SCPs to fix human behavior.

Full breakdown of every permission in the AmazonSSMManagedInstanceCore IAM policy, plus a least-privilege custom alternative for production EC2 instances.

Five real-world AWS incident response scenarios with detection signals, containment steps, CLI commands, and automation examples. Practical guide for security teams.

Five AWS misconfigurations I find in every security audit — with Console and Terraform fixes for public S3 buckets, over-permissive IAM, open security groups, and missing monitoring.

The 30-minute security baseline I run on every AWS account — 10 sections with copy-paste CLI commands covering IAM, S3, CloudTrail, network hardening, and cost monitoring.

10 actionable EKS security best practices covering IRSA, RBAC, network policies, pod security standards, image scanning, secrets encryption, and node hardening.

Stop using IAM users in AWS. This guide explains why they’re risky and how to migrate to Identity Center, STS, and OIDC-based access — step-by-step.

How to map, audit, and automate CIS Benchmark compliance for EC2 instances using AWS Config, Security Hub, SSM, and open-source scanners.

Practical EKS security checklist — control plane audit logs, Falco runtime detection, GuardDuty for containers, and the monitoring gaps most teams miss.

Deep dive into IDOR vulnerabilities with real AWS API examples, bug bounty cases, and prevention strategies for Lambda, API Gateway, and internal tooling.