AWS Security
36 items across 1 section
Serverless Doesn't Mean Secure: The State of AWS Lambda Security in 2026
Part 1 of 4 in the Lambda Security Series. Why "managed" doesn't mean secure: overprivileged execution roles, secrets in environment variables, public function URLs, deprecated runtimes, and event-data injection.
Inside lambda-security-scanner: 19 Checks Across Every Function in Your Account
Part 2 of 4 in the Lambda Security Series. A deep look at lambda-security-scanner: 19 read-only checks across configuration, access control, network, logging, and supply chain, scored 0 to 100 and mapped to ten compliance frameworks.
From Findings to Fixed: Lambda Compliance Mapping and Remediation
Part 3 of 4 in the Lambda Security Series. Map every Lambda security finding to ten compliance frameworks (PCI DSS, HIPAA, SOC 2, ISO 27001, NIST, GDPR), then fix each of the 19 checks with a precise AWS CLI command.
The Code Is Still Yours: Application-Layer Security for AWS Lambda
Part 4 of 4 in the Lambda Security Series. The half no posture scanner reaches: event-data injection, stealable execution-role credentials, insecure deserialization, dependency and code scanning, runtime secrets, and detection.
Build a Free AWS Security Lab on Your Laptop with LocalEmu
Spin up a local AWS, plant deliberately insecure resources, and run real security scanners against it. No account, no token, no cost, no risk.
Fixing EC2 Security Issues: A Practical Remediation Guide
Part 3 of 3 in the EC2 Security Series. A hands-on remediation guide mapped to the scanner findings: AWS CLI commands, Terraform snippets, and console steps for every category.
Building an EC2 Security Scanner: 46 Checks, 137 Controls, Zero Excuses
Part 2 of 3 in the EC2 Security Series. One open-source command that scores every EC2 instance 0-100 across 46 checks and maps each finding to 137 controls in 10 compliance frameworks.
Your EC2 Instances Are Probably Exposed Right Now
Part 1 of 3 in the EC2 Security Series. The real EC2 attack surface, from IMDSv1 and secrets in UserData to public snapshots, and the breaches that prove it matters.
Run AI Locally for AWS Security Work: The Complete Ollama Guide
Stop sending your IAM policies, CloudTrail logs, and infrastructure code to third-party APIs. Run LLMs locally with Ollama on Apple Silicon: private, offline, fast. Complete setup guide with AWS security use cases.
We Detonated the Real LiteLLM Malware on EC2: Here's What Happened
We obtained the actual compromised litellm packages, set up a disposable EC2 instance with honeypot credentials and mitmproxy, and detonated the malware. Full evidence: fork bomb, credential theft in under 2 seconds, IMDS queries, AWS API calls, and C2 exfiltration.
Anatomy of a Supply Chain Attack: How LiteLLM Was Weaponized in 6 Hours
A deep technical breakdown of how threat actor TeamPCP compromised Trivy, pivoted to LiteLLM, and turned a popular AI proxy into a credential-stealing weapon targeting AWS IMDS, Secrets Manager, and Kubernetes.
AWS Security Audit Checklist: The Complete 2026 Guide
A comprehensive AWS security audit checklist covering IAM, S3, networking, logging, and compliance. Follow this step-by-step guide to secure your AWS infrastructure.
AWS IAM Security Best Practices: A Comprehensive Guide
Learn the essential AWS IAM best practices to secure your cloud environment. Covers least privilege, MFA, roles, policies, and access management strategies.
AWS S3 Security: How to Prevent Data Leaks in 2026
Complete guide to securing your AWS S3 buckets. Learn how to prevent data leaks with bucket policies, encryption, access controls, and monitoring.
AWS Compliance Guide: HIPAA, GDPR, PCI DSS & SOC 2
Navigate AWS compliance requirements for HIPAA, GDPR, PCI DSS, and SOC 2. Learn which AWS services help you meet regulatory obligations.
I Built a Free AWS IAM Activity Tracker Because CloudTrail Alone Isn't Enough
A serverless IAM activity monitoring tool that tracks IAM, STS, and console signin events across all AWS regions with real-time security alerts and long-term analytics.
The Hidden Backbone of the Internet: Why S3 Security Should Keep You Up at Night
Part 1 of the S3 Security Series. Explore the major S3 data breaches of the past decade and why Amazon S3 security matters more than most people realize.
The Anatomy of S3 Security: 22 Checks That Stand Between You and a Data Breach
Part 2 of the S3 Security Series. Learn the 22 critical security checks every S3 bucket needs, mapped to 9 compliance frameworks including CIS, PCI-DSS, and HIPAA.
Building an S3 Security Scanner: From Frustration to Open Source
Part 3 of the S3 Security Series. Learn about the open-source S3 Security Scanner tool that automates 22 security checks, DNS takeover detection, and bucket discovery.
Fixing S3 Security Issues: A Practical Remediation Guide
Part 4 of the S3 Security Series. Step-by-step remediation for critical S3 security issues with AWS Console, CLI, and Python boto3 examples.
AWS Security & Cost Optimization Arsenal: From CLI to Lambda Automation
Introducing a 14-episode series of production-ready AWS security and cost optimization scripts. Each tool comes as both a CLI version and a Lambda version for automated monitoring.
Episode 1: Hunting Deprecated Lambda Runtimes - Before They Become Problems
Learn how to systematically identify Lambda functions running on deprecated runtimes across all AWS regions with CLI and Lambda automation tools.
Episode 2: The MFA Enforcement Scanner - Automating Your Security Blind Spot
Build an automated MFA compliance scanner that identifies IAM users with console access but no MFA enabled, with risk-based prioritization and Lambda monitoring.
Episode 3: Public RDS Detective - Finding Your Exposed Databases Before Attackers Do
Build automated scanners that identify publicly accessible RDS databases, analyze security groups, check encryption, and generate remediation commands across all AWS regions.
Episode 4: S3 Exposure Hunter - Preventing the Data Breaches That Make Headlines
Detect and remediate exposed S3 buckets by analyzing ACLs, bucket policies, public access blocks, and website hosting configurations with automated scanning tools.
Episode 5: Load Balancer Security Auditor - SSL, Protocols, and Public Exposure
Audit all AWS load balancers across regions in one command. Detect HTTP listeners on public ALBs, outdated TLS policies, unhealthy targets, and insecure configurations.
IAM Fundamentals: Your First Line of Defense in AWS
A practical guide to AWS Identity and Access Management covering users, groups, roles, and policies with hands-on Python examples.
IAM Policies Mastery: From Zero to Advanced Permission Control
Deep dive into AWS IAM policies covering policy types, evaluation logic, condition keys, advanced patterns, and common pitfalls with real-world examples.
IAM Roles Demystified: Cross-Account Access and Federation
Complete guide to AWS IAM roles covering trust policies, cross-account architecture, service roles, SAML/OIDC federation, and the confused deputy problem.
IAM Access Keys and Credential Management: The Security Lifecycle
Enterprise-grade strategies for AWS credential lifecycle management including rotation automation, monitoring, Secrets Manager, and compliance reporting.
HashiCorp Vault with AWS: What It Is and Why Dynamic Secrets Matter
Understanding HashiCorp Vault, why traditional credential management is broken, how dynamic secrets work, and hands-on setup of the AWS secrets engine with role-based credential generation.
Vault Authentication and Python Integration: From AppRole to Production Code
Deep dive into Vault authentication methods including AppRole and AWS IAM auth, with a complete Python application that uses dynamic AWS credentials transparently.
Production Vault Deployment on AWS: From Terraform to Monitoring
Complete guide to deploying HashiCorp Vault in production on AWS with Terraform, KMS auto-unseal, Raft storage, TLS, load balancing, auto scaling, monitoring, and backup strategies.
I Just Became an AWS Community Builder ... And I Owe It to You
A thank you to my readers, and a call to support open source AWS tools.
Key AWS Security Updates in 2025 - Complete Timeline
The most impactful AWS security changes in 2025: SCPs got full IAM language support, GuardDuty detects multi-stage attacks, Inspector expanded to SAST and IaC, post-quantum cryptography arrived, and HashiCorp deprecated CDKTF.
AWS Security Cards: Free Offensive Security Reference for 60 AWS Services
Free, open-source security reference cards covering attack vectors, misconfigurations, enumeration commands, privilege escalation, persistence, detection, and defense for 60 AWS services.
Need Help with AWS Security?
Our AWS security experts can help you implement best practices across all these topics.
Contact Us