EKS Security Monitoring: Audit Logs, Falco Runtime Detection & GuardDuty
Practical EKS security checklist — control plane audit logs, Falco runtime detection, GuardDuty for containers, and the monitoring gaps most teams miss.
Posts
eJPTv2 Prep Guide: Study Plan for Cloud Security Engineers
If your background is cloud security and you’re thinking about breaking into pentesting, the eJPTv2 is a solid entry point. I prepared for it coming from years of AWS security work — hardening infrastructure, responding to incidents, writing detection rules — and found the study process both natural and surprisingly humbling. This post covers how I prepared, what resources were worth the time, and how a defender’s background actually helps (and where it blinds you). ...
IDOR in AWS APIs: Real Examples from Bug Bounty & How to Fix Them
Deep dive into IDOR vulnerabilities with real AWS API examples, bug bounty cases, and prevention strategies for Lambda, API Gateway, and internal tooling.
AWS GuardDuty Setup: Route Findings to Slack & Your SIEM in 10 Minutes
Enable GuardDuty, filter noisy findings by severity, and wire EventBridge alerts to Slack or your SIEM — with Terraform and Console steps.
Detect AWS IAM Privilege Escalation with CloudTrail
Set up AWS-native detection for privilege escalation using CloudTrail, EventBridge, and minimal infrastructure. Real API patterns and alerting included.
Hardened Amazon Linux 2 AMI with EC2 Image Builder
Step-by-step guide to build a hardened Amazon Linux 2 AMI with EC2 Image Builder including CIS benchmarks, IMDSv2 enforcement, auditd, and logging configuration.
IAM Least Privilege in AWS: Access Analyzer Guide
How to audit and refine IAM permissions using Access Analyzer, CloudTrail, and service access history — enforcing least privilege the right way in AWS.
AWS Session Manager Setup: Replace SSH with Zero Inbound Ports
Step-by-step SSM Session Manager setup — IAM role, instance profile, session logging, and removing SSH entirely. No keys, no bastions, no port 22.
EC2 Hardening Guide: Secure AWS Instances Step by Step
This guide delves into the technical aspects of hardening EC2 instances, covering topics from instance selection to monitoring and automation, aligning with AWS’s security recommendations.
AWS Incident Response Toolkit: Playbook, Terraform Automation & Forensic Tools
A complete incident response toolkit for AWS — playbook template, Terraform notification pipeline, Lambda alert functions, and a forensic tool reference. Free download.
AWS Security Monitoring Without the Enterprise Price Tag
How to build a real AWS security monitoring stack without enterprise pricing — using CloudTrail, EventBridge, GuardDuty, and open-source tools like Wazuh and OpenSearch.
Stop Using AWS Access Keys: The Temporary Credentials Playbook
Kill long-term AWS access keys for good. A step-by-step playbook using IAM roles and STS to lock down access in under a day — with the mistakes to skip.
AWS Incident Response Guide: The Framework for Cloud-Native IR (2026)
The full framework for AWS incident response — why cloud IR is fundamentally different, how to build maturity progressively, and how to actually test your plan with tabletop exercises.
How I Passed the AWS Certified Security – Specialty (SCS-C02) Exam in 2025
My real-world journey passing the AWS Certified Security – Specialty (SCS-C02) exam. Study strategies, mistakes, resources, and tips for future candidates.
Automate IAM Least Privilege with Access Analyzer & Terraform
Automate least-privilege IAM roles using Access Analyzer policy generation, CloudTrail-based scoping, and Terraform integration.
How to Detect AWS Root Account Usage (And Respond to It)
Detect and alert on AWS root account usage using CloudTrail, EventBridge, SNS, and optional Slack notifications. Step-by-step setup with CLI commands and Terraform included.