This post is a cursed compendium of 69 ways to f*** up your deploy. It is the irreverent Grimms Brothers version of deployment scenarios.   #attack   #ci/cd   #defend

Learn what tools and data sources you need to use in cloud forensics investigation and how they come into practice in a real-life example.   #containers   #defend   #kubernetes   #monitor

The Carta team aimed to build an automated detection system that is adaptable, flexible, reproducible, and generates high-quality alerts for security teams to respond to. You can also refer to the companion tool.   #monitor

There are multiple techniques for containing compromised instance credentials. The easy ones are the most likely to break things, but there are creative options to lock out attackers without breaking applications.   #aws   #defend

AWS has recently released VPC Lattice to General Availability. This post walks through creating a simple VPC Lattice service using CloudFormation, and takes a look at the service overall.   #aws   #explain

Docker Desktop introduced Docker Scout, a tool that provides visibility into image vulnerabilities and recommendations for quick remediation.   #announcement   #containers   #defend

This is the first article in a two-part series explaining everything you need to know about running WebAssembly workloads on Kubernetes.   #explain   #kubernetes

These vulnerabilities leaked configuration information across tenant boundaries. While they are both minor issues, they further demonstrate that undocumented AWS APIs have lacked the scrutiny of AWS as well as the cloud security community.   #attack   #aws

The fuzzing involved enrolling Helm in the OSS-Fuzz project and writing a set of fuzzers that further enriches the test coverage of Helm. In total, 38 fuzzers were written, and nine bugs were found (with eight fixed so far).   #defend   #kubernetes

SLSA v1.0 Release Candidate 2 has been announced. This is intended to be the final release candidate before marking v1.0 as an Approved Specification.   #announcement   #supply-chain

A GitHub Action for pip-audit.

Compares and analyzes GCP IAM roles.

GitHub Action for authenticating to Google Cloud with GitHub Actions OIDC tokens and Workload Identity Federation.

A detailed playbook that will provide you with hands-on experience provisioning and using a VPC endpoint to better understand how it works.

Trurl is a command line tool for URL parsing and manipulation.

Post sharing logging options across the typical cloud application stack, log analysis options, and sample queries.

AWS Cloud Development Kit (CDK) now enables developers to validate Infrastructure as Code (IaC) templates against policy-as-code tools during the development lifecycle.

How to manage credentials with many accounts, automate IAM credential reports, and consolidate the results.

VPC Lattice is a new capability of Amazon VPC that gives you a consistent way to connect, secure, and monitor communication between your services.

With AWS Service Catalog, you can create, govern, and manage a catalog of infrastructure as code (IaC) templates that are approved for use on AWS.

GCP now allows to use a dry-run organization policy to monitor how a policy change would impact your workflows before it is enforced.

GKE Autopilot provides faster time-to-market, always-on reliability, an improved security posture, and lower TCO for managed Kubernetes.

BigQuery data clean rooms can help organizations create and manage secure environments for privacy-centric data sharing, analysis, and collaboration.

To help customers use multi-party computation and Confidential Space, GCP described a reference architecture for implementing MPC-compliant blockchain signing.

Application Gateway v2 is introducing support for private IP only frontend configurations, enhanced control over NSG rules, and support for forced tunneling/route table rules to virtual appliances.