I've refreshed my article which covers how to design a state of the art multi-account security logging platform in AWS: removed stale links and legacy advice on MFA delete, added API Gateway access logs, and added a "Tracking Misconfigurations" section.   #aws   #design   #monitor

There is a growing trend of delegating security remediation tasks to employees directly through Slack, rather than relying solely on the security team.   #defend   #strategy

Have you ever thought about how an image is actually pushed or pulled from a registry?   #containers   #explain

There are 27 basic condition operators you can use in an AWS IAM policy. Then you can add "ForAllValues" or "ForAnyValue" to the beginning and "IfExists" to the end of almost all of them.   #aws   #explain   #iam

This article explores Terraform Stacks, a new feature in Terraform Cloud that allows you to manage multiple environments and deployments of Terraform configurations.   #hashicorp   #iac   #terraform

Post revisiting the Kubernetes feature known as k8s checkpoint, demonstrating how it can be automated using Falco components, allowing to create container snapshots that are invaluable for Digital Forensics and Incident Response (DFIR) analysis.   #defend   #kubernetes   #monitor

This library enables to use Amazon S3 as a git remote and LFS server.

A tool designed to simplify the long-term retention and searchability of cloud logs from cloud platforms like AWS and Azure. You can also refer to the companion blog post.

This tool allows you to be able to retrieve all documentation for GCP providing you with a local copy you can archive, search, and diff for security research.

ServiceLens is a Python tool for analyzing services linked to Microsoft 365 domains. It scans DNS records like SPF and DMARC to identify services, categorizing them into Email, Cloud, Security, and more.

This CTF setup will create a misconfigured GCP project that is vulnerable to the internet.

Terraform module for a secret with owner/writer/reader roles. You can also refer to the companion blog post.

Terraform code generator to create different Azure security labs.

Post outlining the steps to follow to build your own Security Guardians program for your organization.

Four security objectives that VPC endpoints help you achieve.

How to integrate Amazon Detective with AWS Security Hub, giving you better visibility into threat indicators and investigative data directly from Security Hub, which provides you with a centralized view of your overall security posture across your AWS accounts.