This blog is for engineering teams responsible for defining and implementing a workload identity platform and access controls rooted in Zero Trust principles to mitigate the risks from compromised services.   #build   #kubernetes

Unit 42 researchers test container escape methods and possible impacts within a Kubernetes cluster using a containerd container runtime.   #attack   #containers   #kubernetes

Post discussing the risks of exposed container labels in cAdvisor metrics with a case study of a widely used cloud native application proxy known as Traefik proxy.   #attack   #containers

Post discussing the evolution of Detection as Code over the past five years, sharing insights from client implementations, and exploring current best practices in this approach.   #monitor

This blog focuses on AWS Bedrock and its relevant telemetry streams: CloudTrail management and data events, model invocation telemetry and endpoint telemetry.   #aws   #monitor

AWS WAF is definitely not the best DDOS prevention tech on the market. But if you're ever in the seat and it's the tool you have, here's your guide.   #aws   #defend

The AWS Client VPN service is a common way to seamlessly connect users into internal networks. This post describes a low-tech, low-cost solution to better authenticate users using a second factor.   #aws   #build

Is GuardDuty all you need for AWS threat detection? This post offers some results of adversarial simulation, a review of detection latency, and an analysis of projected S3 ransomware timing.   #aws   #defend   #explain

You can use S3 as a container registry. All it takes is to expose an S3 bucket through HTTP and to upload the image's files to specific paths.   #aws   #build

The Container Structure Tests provide a powerful framework to validate the structure of a container image. These tests can be used to check the output of commands in an image, as well as verify metadata and contents of the filesystem.

The missing glue to put together large Kubernetes deployments, composed of multiple smaller parts (Helm/Kustomize/...) in a manageable and unified way.

Kubernetes Operator to sync secrets between different secret backends and Kubernetes.

A client-side HTTP service that you can use to standardize consumption of secrets from Secrets Manager across environments such as Lambda, ECS, EKS, and EC2.

Three patterns to centralize the ingestion of log data into Amazon Security Lake, regardless of the source.

The Workload Manager evaluation service can assess SAP systems against best practices from Google Cloud, SAP, and operating system vendors.

The Google Distributed Cloud air-gapped appliance is an integrated hardware and software solution that lets you run workloads at the tactical edge.

New capabilities to help accelerate your transition to a Zero Trust security model with the general availability of the Microsoft Entra Suite.