AWS Security
53 items across 1 section
Serverless Doesn't Mean Secure: The State of AWS Lambda Security in 2026
Part 1 of 4 in the Lambda Security Series. Why "managed" doesn't mean secure: overprivileged execution roles, secrets in environment variables, public function URLs, deprecated runtimes, and event-data injection.
Inside lambda-security-scanner: 19 Checks Across Every Function in Your Account
Part 2 of 4 in the Lambda Security Series. A deep look at lambda-security-scanner: 19 read-only checks across configuration, access control, network, logging, and supply chain, scored 0 to 100 and mapped to ten compliance frameworks.
From Findings to Fixed: Lambda Compliance Mapping and Remediation
Part 3 of 4 in the Lambda Security Series. Map every Lambda security finding to ten compliance frameworks (PCI DSS, HIPAA, SOC 2, ISO 27001, NIST, GDPR), then fix each of the 19 checks with a precise AWS CLI command.
The Code Is Still Yours: Application-Layer Security for AWS Lambda
Part 4 of 4 in the Lambda Security Series. The half no posture scanner reaches: event-data injection, stealable execution-role credentials, insecure deserialization, dependency and code scanning, runtime secrets, and detection.
Build a Free AWS Security Lab on Your Laptop with LocalEmu
Spin up a local AWS, plant deliberately insecure resources, and run real security scanners against it. No account, no token, no cost, no risk.
Fixing EC2 Security Issues: A Practical Remediation Guide
Part 3 of 3 in the EC2 Security Series. A hands-on remediation guide mapped to the scanner findings: AWS CLI commands, Terraform snippets, and console steps for every category.
Building an EC2 Security Scanner: 46 Checks, 137 Controls, Zero Excuses
Part 2 of 3 in the EC2 Security Series. One open-source command that scores every EC2 instance 0-100 across 46 checks and maps each finding to 137 controls in 10 compliance frameworks.
Your EC2 Instances Are Probably Exposed Right Now
Part 1 of 3 in the EC2 Security Series. The real EC2 attack surface, from IMDSv1 and secrets in UserData to public snapshots, and the breaches that prove it matters.
Run AI Locally for AWS Security Work: The Complete Ollama Guide
Stop sending your IAM policies, CloudTrail logs, and infrastructure code to third-party APIs. Run LLMs locally with Ollama on Apple Silicon: private, offline, fast. Complete setup guide with AWS security use cases.
We Detonated the Real LiteLLM Malware on EC2: Here's What Happened
We obtained the actual compromised litellm packages, set up a disposable EC2 instance with honeypot credentials and mitmproxy, and detonated the malware. Full evidence: fork bomb, credential theft in under 2 seconds, IMDS queries, AWS API calls, and C2 exfiltration.
Anatomy of a Supply Chain Attack: How LiteLLM Was Weaponized in 6 Hours
A deep technical breakdown of how threat actor TeamPCP compromised Trivy, pivoted to LiteLLM, and turned a popular AI proxy into a credential-stealing weapon targeting AWS IMDS, Secrets Manager, and Kubernetes.
AWS Security Audit Checklist: The Complete 2026 Guide
A comprehensive AWS security audit checklist covering IAM, S3, networking, logging, and compliance. Follow this step-by-step guide to secure your AWS infrastructure.
AWS IAM Security Best Practices: A Comprehensive Guide
Learn the essential AWS IAM best practices to secure your cloud environment. Covers least privilege, MFA, roles, policies, and access management strategies.
AWS S3 Security: How to Prevent Data Leaks in 2026
Complete guide to securing your AWS S3 buckets. Learn how to prevent data leaks with bucket policies, encryption, access controls, and monitoring.
AWS Compliance Guide: HIPAA, GDPR, PCI DSS & SOC 2
Navigate AWS compliance requirements for HIPAA, GDPR, PCI DSS, and SOC 2. Learn which AWS services help you meet regulatory obligations.
I Built a Free AWS IAM Activity Tracker Because CloudTrail Alone Isn't Enough
A serverless IAM activity monitoring tool that tracks IAM, STS, and console signin events across all AWS regions with real-time security alerts and long-term analytics.
The Hidden Backbone of the Internet: Why S3 Security Should Keep You Up at Night
Part 1 of the S3 Security Series. Explore the major S3 data breaches of the past decade and why Amazon S3 security matters more than most people realize.
The Anatomy of S3 Security: 22 Checks That Stand Between You and a Data Breach
Part 2 of the S3 Security Series. Learn the 22 critical security checks every S3 bucket needs, mapped to 9 compliance frameworks including CIS, PCI-DSS, and HIPAA.
Building an S3 Security Scanner: From Frustration to Open Source
Part 3 of the S3 Security Series. Learn about the open-source S3 Security Scanner tool that automates 22 security checks, DNS takeover detection, and bucket discovery.
Fixing S3 Security Issues: A Practical Remediation Guide
Part 4 of the S3 Security Series. Step-by-step remediation for critical S3 security issues with AWS Console, CLI, and Python boto3 examples.
AWS Security & Cost Optimization Arsenal: From CLI to Lambda Automation
Introducing a 14-episode series of production-ready AWS security and cost optimization scripts. Each tool comes as both a CLI version and a Lambda version for automated monitoring.
Episode 1: Hunting Deprecated Lambda Runtimes - Before They Become Problems
Learn how to systematically identify Lambda functions running on deprecated runtimes across all AWS regions with CLI and Lambda automation tools.
Episode 2: The MFA Enforcement Scanner - Automating Your Security Blind Spot
Build an automated MFA compliance scanner that identifies IAM users with console access but no MFA enabled, with risk-based prioritization and Lambda monitoring.
Episode 3: Public RDS Detective - Finding Your Exposed Databases Before Attackers Do
Build automated scanners that identify publicly accessible RDS databases, analyze security groups, check encryption, and generate remediation commands across all AWS regions.
Episode 4: S3 Exposure Hunter - Preventing the Data Breaches That Make Headlines
Detect and remediate exposed S3 buckets by analyzing ACLs, bucket policies, public access blocks, and website hosting configurations with automated scanning tools.
Episode 5: Load Balancer Security Auditor - SSL, Protocols, and Public Exposure
Audit all AWS load balancers across regions in one command. Detect HTTP listeners on public ALBs, outdated TLS policies, unhealthy targets, and insecure configurations.
IAM Fundamentals: Your First Line of Defense in AWS
A practical guide to AWS Identity and Access Management covering users, groups, roles, and policies with hands-on Python examples.
IAM Policies Mastery: From Zero to Advanced Permission Control
Deep dive into AWS IAM policies covering policy types, evaluation logic, condition keys, advanced patterns, and common pitfalls with real-world examples.
IAM Roles Demystified: Cross-Account Access and Federation
Complete guide to AWS IAM roles covering trust policies, cross-account architecture, service roles, SAML/OIDC federation, and the confused deputy problem.
IAM Access Keys and Credential Management: The Security Lifecycle
Enterprise-grade strategies for AWS credential lifecycle management including rotation automation, monitoring, Secrets Manager, and compliance reporting.
HashiCorp Vault with AWS: What It Is and Why Dynamic Secrets Matter
Understanding HashiCorp Vault, why traditional credential management is broken, how dynamic secrets work, and hands-on setup of the AWS secrets engine with role-based credential generation.
Vault Authentication and Python Integration: From AppRole to Production Code
Deep dive into Vault authentication methods including AppRole and AWS IAM auth, with a complete Python application that uses dynamic AWS credentials transparently.
Production Vault Deployment on AWS: From Terraform to Monitoring
Complete guide to deploying HashiCorp Vault in production on AWS with Terraform, KMS auto-unseal, Raft storage, TLS, load balancing, auto scaling, monitoring, and backup strategies.
I Just Became an AWS Community Builder ... And I Owe It to You
A thank you to my readers, and a call to support open source AWS tools.
Key AWS Security Updates in 2025 - Complete Timeline
The most impactful AWS security changes in 2025: SCPs got full IAM language support, GuardDuty detects multi-stage attacks, Inspector expanded to SAST and IaC, post-quantum cryptography arrived, and HashiCorp deprecated CDKTF.
AWS Security Cards: Free Offensive Security Reference for 60 AWS Services
Free, open-source security reference cards covering attack vectors, misconfigurations, enumeration commands, privilege escalation, persistence, detection, and defense for 60 AWS services.
The Verdict, Four Months Later
Part 16 of 16 in the AWS Security Agent: From Zero to Hero series. Closing the series: the numbers this whole project is built on, the honest verdict distilled to its essentials, what AWS has shipped since my hands-on testing, and an evidence-based look at how AI pentesting stacks up against traditional consultancy today.
The Agent's AWS Footprint
Part 15 of 16 in the AWS Security Agent: From Zero to Hero series. What AWS Security Agent leaves behind in your own account. CloudTrail events, Secrets Manager entries, and VPC Flow Logs, with the commands to audit and observe every run yourself.
Attacking the Agent Itself
Part 14 of 16 in the AWS Security Agent: From Zero to Hero series. What AWS itself documents about AWS Security Agent as its own attack surface: the guardrails it publishes, how it limits its own blast radius, and how domain ownership and data handling are enforced. Sourced entirely from AWS's public documentation, not hands-on testing.
We Tried to Trick the Agent
Part 13 of 16 in the AWS Security Agent: From Zero to Hero series. Adversarial evasion experiments against AWS Security Agent: code obfuscation, prompt injection in design documents and pull requests, fake sanitizers, and misleading comments. Almost every obfuscated vulnerability was still detected (18 of 19), and every injection attempt in these runs was ignored.
What It Catches and What It Misses
Part 12 of 16 in the AWS Security Agent: From Zero to Hero series. An honest, data-driven account of where AWS Security Agent falls short, with a practical fix for each weakness, plus why results vary from run to run and why a single run undercounts.
How We Measured Detection Rate
Part 11 of 16 in the AWS Security Agent: From Zero to Hero series. The full measurement methodology behind this series. A purpose-built application with 39 intentional vulnerabilities, a JSON answer key, false-positive controls, and a scoring scheme you can reproduce.
Inside the Engine: What the Logs Reveal
Part 10 of 16 in the AWS Security Agent: From Zero to Hero series. A data-driven walk through the CloudWatch logs of two real penetration tests: the 14 tools the agent uses, the thousands of reasoning blocks and tool calls, and how the observed behavior maps onto AWS's published multi-agent stages.
Advanced Pentesting: VPC and Cross-Account
Part 9 of 16 in the AWS Security Agent: From Zero to Hero series. Testing private applications inside a VPC with the agent's ENI model, the network constraints that actually matter, and cross-account shared VPC pentesting via AWS Resource Access Manager added in February 2026.
Pentesting With Credentials
Part 8 of 16 in the AWS Security Agent: From Zero to Hero series. I ran the same pentest twice against the same application. The only change was providing a username and password. Findings went from 5 to 13, a 160 percent increase, including two critical JWT bypasses and a privilege escalation.
Your First Penetration Test
Part 7 of 16 in the AWS Security Agent: From Zero to Hero series. Creating an on-demand penetration test in AWS Security Agent and watching each agent component work, from the TLS scanner to the crawler that discovered only 7 of the 48 scored endpoints on its own.
Custom Security Requirements
Part 6 of 16 in the AWS Security Agent: From Zero to Hero series. How I wrote one custom security requirement, an IDOR authorization check, and turned a 9/10 code review detection rate into 10/10. The five-field form, character limits, and the worked example, all from a controlled experiment.
Code Reviews and GitHub
Part 5 of 16 in the AWS Security Agent: From Zero to Hero series. Connecting GitHub to AWS Security Agent, the analysis-type trap that produces silent reviews, what the agent caught in a deliberately vulnerable Flask app (9 of 10), and the new full-repository review that entered preview on May 12, 2026.
Design Reviews
Part 4 of 16 in the AWS Security Agent: From Zero to Hero series. Running a design review on an intentionally insecure architecture document, reading the four compliance statuses, and a finding the AWS docs do not mention: file format changes the results.
Setting Up From Scratch
Part 3 of 16 in the AWS Security Agent: From Zero to Hero series. A field-tested walkthrough of setting up AWS Security Agent: choosing an access method, creating an Agent Space, the two IAM roles, the service principal, and domain verification, including the one-click verification gotcha the docs do not warn you about.
The Web Application Security Survival Kit
Part 2 of 16 in the AWS Security Agent: From Zero to Hero series. A hands-on guide to every vulnerability class AWS Security Agent tests for, with vulnerable code, the exact attacker requests, and why each one is dangerous. Read it early, before the hands-on posts.
What Is AWS Security Agent
Part 1 of 16 in the AWS Security Agent: From Zero to Hero series. A data-driven introduction to AWS Security Agent, the AI penetration testing service that went GA in March 2026. What it does, how it is priced, and one real CVSS 10.0 finding from my own testing.
KloudSec Is Live. This Is My Fight for Every Company That Isn't a Giant.
KloudSec, an agentless AWS security platform, is live. Why I built it, and why small and growing companies deserve the same protection as the largest ones.
Need Help with AWS Security?
Our AWS security experts can help you implement best practices across all these topics.
Contact Us