Blog

Hands-on cloud security& career insight.

Practical tutorials, career roadmaps, and AWS / SOC security writing from the team.

From SSRF to Stolen EC2 Role Credentials: Killing the IMDSv1 Attack Chain

How an SSRF bug becomes full IAM-role credential theft through the instance metadata service, and how to enforce IMDSv2 org-wide with SCPs, condition keys, and GuardDuty detection.

Jun 6, 2026

Cloud / AWS7 min

IAM least-privilege without breaking production

How to cut over-broad AWS permissions methodically — driven by what your workloads actually do — without taking prod down.

Jun 4, 2026

Cloud / AWS6 min

Secure S3: the settings that stop a data leak

Almost every S3 breach is a misconfiguration, not a hack. Here are the few settings that prevent nearly all of them.

Jun 2, 2026

Detection & Response10 min

Reconstructing a Data-Exfiltration Breach from CloudTrail with Athena

When an S3 bucket leaks, your CloudTrail logs already hold the full story. Here is how to query them with Athena, pivot across identity and network signals, and rebuild the attacker's timeline from first API call to final GetObject.

Jun 1, 2026

Cloud / AWS8 min

Respond to a leaked AWS access key — fast

A step-by-step incident playbook for a leaked AWS key: contain, scope the blast radius, eradicate, and prevent the next one.

May 30, 2026

Detection & Response9 min

Which GuardDuty Findings Actually Matter, and How to Auto-Respond

GuardDuty emits hundreds of finding types, but only a handful warrant a pager. A working engineer's guide to separating high-signal compromise indicators from recon noise, writing suppression rules that don't blind you, and wiring EventBridge to Lambda and SSM for automated containment.

May 27, 2026

Cloud / AWS10 min

KMS Key Policies, Grants, and Secure Cross-Account Encryption

A deep, practical guide to AWS KMS authorization: how key policies, IAM, and grants actually interact, and how to build least-privilege cross-account encryption that holds up under review.

May 22, 2026

Cloud / AWS11 min

A Practical SCP Guardrail Library for AWS Organizations

A field-tested set of Service Control Policies that cap what any account can do, with exception patterns that survive break-glass and CI/CD reality. Copy, scope, deploy.

May 17, 2026

Cloud / AWS9 min

Cross-Account IAM Roles Done Right: ExternalId, aws:SourceArn, and the Confused Deputy

A working engineer's guide to hardening cross-account trust policies against the confused-deputy problem, with the exact conditions that separate a safe vendor integration from a tenant-isolation breach.

May 12, 2026

Cloud / AWS10 min

VPC Network Security Deep-Dive: Flow Logs, Security Groups vs NACLs, and Egress Filtering

A working engineer's guide to locking down VPC traffic: where stateful security groups beat stateless NACLs, why default-allow egress is a data-exfiltration liability, and how to hunt anomalous outbound flows in CloudWatch Logs Insights.

May 7, 2026

Cloud / AWS11 min

Container Security on AWS: ECR Scanning, ECS Hardening, and EKS Controls

A practitioner's walkthrough of locking down the container lifecycle on AWS, from Inspector-backed ECR scanning and image signing to ECS task-role isolation, IMDS exposure, EKS IRSA and Pod Identity, and GuardDuty Runtime Monitoring.

May 2, 2026

Cloud / AWS9 min

Serverless Security: Least-Privilege Lambda, Event Injection, and Secrets Handling

Serverless removes the host you used to patch, but it does not remove the attack surface. This is how working engineers harden Lambda execution roles, untrusted event sources, secrets, and Function URLs against real exploitation.

Apr 27, 2026

Detection & Response10 min

AWS Detection Engineering: High-Signal Rules from CloudTrail and GuardDuty

A practical method for turning CloudTrail and GuardDuty into detections that fire on real attacker behavior, not noise. We map TTPs to ATT&CK, baseline normal, enrich for context, and wire findings to automated response.

Apr 22, 2026

Cloud / AWS8 min

Secrets Management on AWS: Secrets Manager vs SSM Parameter Store, Rotation, and Killing Hardcoded Credentials

A deep, engineer-grade comparison of AWS Secrets Manager and SSM Parameter Store: rotation, KMS, least-privilege retrieval, and how to detect secret access in CloudTrail.

Apr 17, 2026

Detection & Response11 min

Cloud Incident Response on AWS: Isolation, Snapshots, and Evidence Preservation

A field-tested AWS incident response playbook for working engineers: contain a compromised instance and credentials, preserve EBS and CloudTrail evidence in a forensic account, and investigate without tipping off the attacker.

Apr 12, 2026

Detection & Response9 min

Attacking and Defending IAM Identity Center: Permission Sets, Persistence, and Detection

How Identity Center maps humans to accounts via permission sets and assignments, what an attacker does with a compromised identity source or delegated admin, and the sso.amazonaws.com and sso-directory events that catch them.

Apr 7, 2026

Cloud / AWS9 min

Ransomware in the Cloud: S3 and EBS Threat Models, Immutability, and Recovery

Cloud ransomware rarely encrypts files in place. It re-keys your S3 objects with the attacker's KMS material, deletes your snapshots, and turns off the safety nets first. Here is the threat model and the immutability controls that survive a compromised admin.

Apr 2, 2026

Cloud / AWS9 min

AWS WAF and Shield: Real Application Protection Beyond Default Rules

Default managed rules and Shield Standard are table stakes, not a strategy. Here is how to design a WAF web ACL that actually blocks attacks without breaking your app or your budget.

Mar 28, 2026

Want this hands-on, not just read?

Jump into a real AWS security lab, or explore our training tracks.

Book a call WhatsApp