Security

Security Hub’s new MCP app brings exposure findings into Claude Desktop. Setup, available tools, and practical use cases for compliance triage and remediation prioritization.

Standard GuardDuty analyzes VPC Flow Logs, CloudTrail events, and DNS queries — all metadata about what happened around your workloads. It sees that an EC2 instance connected to a suspicious IP, but it can’t tell you which process made that connection, what command-line arguments it used, or whether it escalated privileges first. Runtime Monitoring changes that. It deploys a lightweight security agent inside your EC2 instances, EKS pods, and ECS tasks that watches operating system events in real time. Process execution, file access, network connections, privilege changes — all visible to GuardDuty without you writing a single detection rule. ...

As of July 2026, AWS Secrets Manager automatically publishes events to Amazon EventBridge whenever a secret value changes. No opt-in, no configuration, no extra cost. This is a significant improvement for anyone monitoring credential rotation or building event-driven security workflows. Before this, detecting secret changes meant parsing CloudTrail logs and correlating multiple API calls (PutSecretValue, UpdateSecretValue, rotation success/failure) — doable but brittle. Now you get a single, clean event on the default EventBridge bus every time a secret changes. ...

GuardDuty and Security Hub show up in almost every AWS security architecture, but they solve fundamentally different problems. GuardDuty watches what’s happening right now — threat detection. Security Hub checks whether your environment is configured correctly — posture management. They overlap in one specific area (findings), which is where the confusion starts. This post breaks down what each service actually does, where they complement each other, and how to set them up together without redundant noise or wasted spend. ...

Walkthrough of a real phishing-initiated endpoint compromise I investigated. Covers the full attack chain from password-protected PDF to PowerShell loader, forensic analysis in an isolated lab, and the response failures that delayed containment.

How to actually use CloudTrail logs day-to-day — tracing non-compliant resources to their source, querying with Athena, and setting up alerts before things go wrong.

SCPs every AWS org should deploy on day one — plus the break-glass pattern, limit gotchas, and why you shouldn’t use SCPs to fix human behavior.

Full breakdown of every permission in the AmazonSSMManagedInstanceCore IAM policy, plus a least-privilege custom alternative for production EC2 instances.

Five real-world AWS incident response scenarios with detection signals, containment steps, CLI commands, and automation examples. Practical guide for security teams.

10 actionable EKS security best practices covering IRSA, RBAC, network policies, pod security standards, image scanning, secrets encryption, and node hardening.

Practical EKS security checklist — control plane audit logs, Falco runtime detection, GuardDuty for containers, and the monitoring gaps most teams miss.

Deep dive into IDOR vulnerabilities with real AWS API examples, bug bounty cases, and prevention strategies for Lambda, API Gateway, and internal tooling.

Enable GuardDuty, filter noisy findings by severity, and wire EventBridge alerts to Slack or your SIEM — with Terraform and Console steps.

Set up AWS-native detection for privilege escalation using CloudTrail, EventBridge, and minimal infrastructure. Real API patterns and alerting included.

Step-by-step guide to build a hardened Amazon Linux 2 AMI with EC2 Image Builder including CIS benchmarks, IMDSv2 enforcement, auditd, and logging configuration.

How to audit and refine IAM permissions using Access Analyzer, CloudTrail, and service access history — enforcing least privilege the right way in AWS.

Step-by-step SSM Session Manager setup — IAM role, instance profile, session logging, and removing SSH entirely. No keys, no bastions, no port 22.

This guide delves into the technical aspects of hardening EC2 instances, covering topics from instance selection to monitoring and automation, aligning with AWS’s security recommendations.

A complete incident response toolkit for AWS — playbook template, Terraform notification pipeline, Lambda alert functions, and a forensic tool reference. Free download.

Automate least-privilege IAM roles using Access Analyzer policy generation, CloudTrail-based scoping, and Terraform integration.