AWS Security & Cloud Insights
Practical guides, best practices, and expert insights on AWS security, cloud architecture, and compliance from our team of experienced consultants.
90 articles published
The Agent's AWS Footprint
Part 15 of 16 in the AWS Security Agent: From Zero to Hero series. What AWS Security Agent leaves behind in your own account. CloudTrail events, Secrets Manager entries, and VPC Flow Logs, with the commands to audit and observe every run yourself.
Attacking the Agent Itself
Part 14 of 16 in the AWS Security Agent: From Zero to Hero series. What AWS itself documents about AWS Security Agent as its own attack surface: the guardrails it publishes, how it limits its own blast radius, and how domain ownership and data handling are enforced. Sourced entirely from AWS's public documentation, not hands-on testing.
We Tried to Trick the Agent
Part 13 of 16 in the AWS Security Agent: From Zero to Hero series. Adversarial evasion experiments against AWS Security Agent: code obfuscation, prompt injection in design documents and pull requests, fake sanitizers, and misleading comments. Almost every obfuscated vulnerability was still detected (18 of 19), and every injection attempt in these runs was ignored.
What It Catches and What It Misses
Part 12 of 16 in the AWS Security Agent: From Zero to Hero series. An honest, data-driven account of where AWS Security Agent falls short, with a practical fix for each weakness, plus why results vary from run to run and why a single run undercounts.
How We Measured Detection Rate
Part 11 of 16 in the AWS Security Agent: From Zero to Hero series. The full measurement methodology behind this series. A purpose-built application with 39 intentional vulnerabilities, a JSON answer key, false-positive controls, and a scoring scheme you can reproduce.
Inside the Engine: What the Logs Reveal
Part 10 of 16 in the AWS Security Agent: From Zero to Hero series. A data-driven walk through the CloudWatch logs of two real penetration tests: the 14 tools the agent uses, the thousands of reasoning blocks and tool calls, and how the observed behavior maps onto AWS's published multi-agent stages.
Advanced Pentesting: VPC and Cross-Account
Part 9 of 16 in the AWS Security Agent: From Zero to Hero series. Testing private applications inside a VPC with the agent's ENI model, the network constraints that actually matter, and cross-account shared VPC pentesting via AWS Resource Access Manager added in February 2026.
Pentesting With Credentials
Part 8 of 16 in the AWS Security Agent: From Zero to Hero series. I ran the same pentest twice against the same application. The only change was providing a username and password. Findings went from 5 to 13, a 160 percent increase, including two critical JWT bypasses and a privilege escalation.
Page 1 of 10
All Articles
- Advanced Pentesting: VPC and Cross-Account
- Amazon API Gateway Deep Dive: Build and Manage APIs at Any Scale
- Amazon CloudFront Deep Dive: CDN, Caching, and Edge Computing on AWS
- Amazon CloudWatch Deep Dive: Monitoring, Logging, and Observability on AWS
- Amazon DynamoDB Deep Dive: NoSQL at Any Scale
- Amazon RDS Deep Dive: Managed Relational Databases on AWS
- Amazon S3 Deep Dive: Object Storage from Basics to Production
- Amazon SQS and SNS Deep Dive: Messaging and Event-Driven Architecture on AWS
- Anatomy of a Supply Chain Attack: How LiteLLM Was Weaponized in 6 Hours
- Attacking the Agent Itself
- AWS AI and ML Services: Add Intelligence to Your Applications
- AWS Architecture Patterns: Proven Blueprints for Scalable Cloud Applications
- AWS Compliance Guide: HIPAA, GDPR, PCI DSS & SOC 2
- AWS Cost Optimization: Reduce Your Cloud Bill Without Sacrificing Performance
- AWS IAM Security Best Practices: A Comprehensive Guide
- AWS Lambda Deep Dive: Serverless Computing from First Function to Production
- AWS S3 Security: How to Prevent Data Leaks in 2026
- AWS Security & Cost Optimization Arsenal: From CLI to Lambda Automation
- AWS Security Audit Checklist: The Complete 2026 Guide
- AWS Security Cards: Free Offensive Security Reference for 60 AWS Services
- awsmap — Find Everything Running in Your AWS Account
- awsmap v1.5.0: Your AWS Inventory Now Has a Brain
- Build a Free AWS Security Lab on Your Laptop with LocalEmu
- Building a Production-Ready Serverless File Sharing Platform on AWS
- Building an EC2 Security Scanner: 46 Checks, 137 Controls, Zero Excuses
- Building an S3 Security Scanner: From Frustration to Open Source
- Chaos Engineering on AWS: Containers and Serverless with FIS (ECS Fargate and Lambda)
- Chaos Engineering on AWS: CPU, Memory, and Network Faults with AWS FIS and SSM
- Chaos Engineering on AWS: Database Resilience with Aurora Failover, RDS Proxy, and Read/Write Separation
- Chaos Engineering on AWS: Dependency and API Faults with FIS
- Chaos Engineering on AWS: Graceful Degradation with Circuit Breakers, SQS, and a DynamoDB Cache
- Chaos Engineering on AWS: Multi-Region Disaster Recovery and Measuring Real RPO
- Chaos Engineering on AWS: Observability and Stop Conditions with CloudWatch and FIS
- Chaos Engineering on AWS: Running a Program with GameDays and Continuous Chaos
- Chaos Engineering on AWS: Surviving an Availability Zone Failure with FIS and Static Stability
- Chaos Engineering on AWS: Your First Experiment with AWS FIS
- Code Reviews and GitHub
- Containers on AWS: ECR, ECS, and Fargate Deep Dive (Part 1/3)
- Cryptex — Because openssl rand -base64 32 Gets Old Fast
- Custom Security Requirements
- Design Reviews
- EC2 Getting Started: Launch Your First Virtual Server on AWS
- EC2 Instance Types Deep Dive: Choosing the Right Machine for Any Workload
- EC2 Networking and Security: Build Bulletproof Cloud Infrastructure
- ECS Production Patterns: Deployments, Auto-Scaling, and CI/CD (Part 2/3)
- EKS: Kubernetes on AWS Deep Dive (Part 3/3)
- Episode 1: Hunting Deprecated Lambda Runtimes - Before They Become Problems
- Episode 2: The MFA Enforcement Scanner - Automating Your Security Blind Spot
- Episode 3: Public RDS Detective - Finding Your Exposed Databases Before Attackers Do
- Episode 4: S3 Exposure Hunter - Preventing the Data Breaches That Make Headlines
- Episode 5: Load Balancer Security Auditor - SSL, Protocols, and Public Exposure
- Fixing EC2 Security Issues: A Practical Remediation Guide
- Fixing S3 Security Issues: A Practical Remediation Guide
- From Findings to Fixed: Lambda Compliance Mapping and Remediation
- HashiCorp Vault with AWS: What It Is and Why Dynamic Secrets Matter
- How Netflix Serves 300+ Million Users Without Owning a Single Server
- How We Measured Detection Rate
- I Built a Free AWS IAM Activity Tracker Because CloudTrail Alone Isn't Enough
- I Just Became an AWS Community Builder ... And I Owe It to You
- IAM Access Keys and Credential Management: The Security Lifecycle
- IAM Fundamentals: Your First Line of Defense in AWS
- IAM Policies Mastery: From Zero to Advanced Permission Control
- IAM Roles Demystified: Cross-Account Access and Federation
- Inside lambda-security-scanner: 19 Checks Across Every Function in Your Account
- Inside the Engine: What the Logs Reveal
- Key AWS Security Updates in 2025 - Complete Timeline
- Mastering AWS SAM for Python Lambda: The Ultimate Hands-On Guide
- Meet LocalEmu, the Free Successor to LocalStack
- Pentesting With Credentials
- Production Vault Deployment on AWS: From Terraform to Monitoring
- Run AI Locally for AWS Security Work: The Complete Ollama Guide
- Run Real AWS Lambda on Your Laptop
- Serverless Doesn't Mean Secure: The State of AWS Lambda Security in 2026
- Setting Up From Scratch
- Setting Up Your AWS Developer Environment with Python Automation
- Stop Reinventing Authentication: How I Built a Production-Ready Auth API That Scales to 50K Users for Free
- The $10 Billion Mistake That Revolutionized Computing Forever (And Why Your USB Drive Is Now a Museum Piece)
- The Agent's AWS Footprint
- The Anatomy of S3 Security: 22 Checks That Stand Between You and a Data Breach
- The Code Is Still Yours: Application-Layer Security for AWS Lambda
- The Hidden Backbone of the Internet: Why S3 Security Should Keep You Up at Night
- The Verdict, Four Months Later
- The Web Application Security Survival Kit
- Vault Authentication and Python Integration: From AppRole to Production Code
- We Detonated the Real LiteLLM Malware on EC2: Here's What Happened
- We Tried to Trick the Agent
- What Is AWS Security Agent
- What It Catches and What It Misses
- Your EC2 Instances Are Probably Exposed Right Now
- Your First Penetration Test
Need Expert AWS Security Help?
Our team of AWS-certified consultants can help you implement the security best practices discussed in our articles.