CloudSecList is a newsletter for busy professionals who want to keep up to date with the cloud security industry. Hand-curated by Marco Lancini.
If you received it, you either subscribed or someone forwarded it to you. If you fit in the latter camp and want to subscribe, then you can click on this button:
🛡️ The re:Inforce edition 🛡️ With re:Inforce happening this past week, this CloudSecList issue will have a more extensive section showcasing the primary security-related announcements that came out of it. Back to business as usual from next week!
Sponsor
Cloud misconfiguration is the third highest cause of security breaches. Misconfigurations are easier to prevent than to fix. Developers report it can take days to weeks to provision, and it shouldn't! Creating a win-win is possible. Where developers get the cloud infrastructure they need faster than they can get a coffee break. The best part – it's built on a library of golden patterns and protected by guardrails. Netflix Infrastructure Security teams call these solutions paved roads. Resourcely offers cloud infrastructure paved roads as a service. https://www.resourcely.io/#contact
Different methods of executing arbitrary code and executables in read-only file systems where writable folders are marked as noexec, focusing on pods within the Kubernetes context.
HashiCorp Terraform 1.5 is now generally available, featuring a config-driven import workflow and a new language primitive for infrastructure validations.
The Vault Secrets Operator implements a first-class Kubernetes Operator for Vault, along with CRDs responsible for synchronizing Vault secrets to Kubernetes Secrets.
A GitHub Actions workflow that achieves SLSA Build Track Level 3 for provenance generation.
Sponsor
Ready to reduce the need for countless spreadsheets and endless email threads — while saving up to 85% of compliance costs? Vanta is your trust management platform for continuously monitoring your controls, reporting on security posture, and streamlining audit readiness. Maintain centralized visibility into your security status and automate up to 90% of the work for SOC 2, ISO 27001, GDPR, HIPAA, and more. Take a tour of Vanta’s platform to see how it works
You can now view your logs interactively in real-time as they're ingested, which helps you to analyze and resolve issues across your systems and applications.
Amazon Verified Permissions is a scalable permissions management and fine-grained authorization service for the applications that you build. Using Cedar, developers and admins can define policy-based access controls using roles and attributes for more granular, context-aware access control.
Amazon launched S3 dual-layer server-side encryption with keys stored in AWS Key Management Service (DSSE-KMS), a new encryption option in S3 that applies two layers of encryption to objects when they are uploaded to an S3 bucket.
Amazon launched EC2 Instance Connect (EIC) Endpoint, a new feature that allows you to connect securely to your instances and other VPC resources from the Internet.
Amazon shared the availability of AWS Payment Cryptography, an elastic service that manages payment HSMs and keys for payment processing applications in the cloud.
You can now connect a Google Workspace to AWS IAM Identity Center once and manage access to AWS accounts and applications centrally, in IAM Identity Center.
AWS introduced AWS WAF Fraud Control - Account Creation Fraud Prevention (ACFP) to help protect your application's sign-up pages against fake account creation by detecting and blocking fake account creation requests.
Google's new Secure Web Proxy is now generally available. This cloud-first network security offering provides web egress traffic inspection, protection, and control.
Security Command Center's new attack path simulation automatically analyzes a customer's environment to pinpoint where and how vulnerable resources may be attacked.
Users can now specify an AMD SEV-SNP based confidential VM for their Windows 11 Azure Virtual Desktop, allowing the execution of sensitive desktop workloads by protecting data in use.
