IAM
20 items across 5 sections
Serverless Doesn't Mean Secure: The State of AWS Lambda Security in 2026
Part 1 of 4 in the Lambda Security Series. Why "managed" doesn't mean secure: overprivileged execution roles, secrets in environment variables, public function URLs, deprecated runtimes, and event-data injection.
Run AI Locally for AWS Security Work: The Complete Ollama Guide
Stop sending your IAM policies, CloudTrail logs, and infrastructure code to third-party APIs. Run LLMs locally with Ollama on Apple Silicon: private, offline, fast. Complete setup guide with AWS security use cases.
AWS Security Audit Checklist: The Complete 2026 Guide
A comprehensive AWS security audit checklist covering IAM, S3, networking, logging, and compliance. Follow this step-by-step guide to secure your AWS infrastructure.
AWS IAM Security Best Practices: A Comprehensive Guide
Learn the essential AWS IAM best practices to secure your cloud environment. Covers least privilege, MFA, roles, policies, and access management strategies.
HashiCorp Vault with AWS: What It Is and Why Dynamic Secrets Matter
Understanding HashiCorp Vault, why traditional credential management is broken, how dynamic secrets work, and hands-on setup of the AWS secrets engine with role-based credential generation.
Setting Up From Scratch
Part 3 of 16 in the AWS Security Agent: From Zero to Hero series. A field-tested walkthrough of setting up AWS Security Agent: choosing an access method, creating an Agent Space, the two IAM roles, the service principal, and domain verification, including the one-click verification gotcha the docs do not warn you about.
Anatomy of a Real AWS Breach: Capital One, 2019
How a misconfigured WAF, an unauthenticated metadata service, and an over-privileged IAM role combined to expose data on roughly 100 million people in the US and 6 million in Canada, and the specific checks that would have stopped it.
Anatomy of a Real AWS Breach: Code Spaces, 2014
A single compromised AWS console login, no MFA, and a company was gone within 12 hours. The full story, and why "our backups are in AWS too" was the real failure.
AWS IAM Privilege Escalation: Paths, CloudTrail Events, and the Controls That Block Them
Twelve documented ways a limited IAM identity can raise its own permissions, the CloudTrail event each one leaves, and the AWS controls that block them. Commands and policies follow AWS documentation examples and the AWS CLI v2 reference.
iam-to-english: Read Any AWS IAM Policy in Plain English and Catch Privilege Escalation Before It Ships
KloudSec releases iam-to-english, a free open-source CLI that explains AWS IAM policies in plain English, flags 21 known privilege escalation paths, including combinations spread across statements, diffs policy changes and gates CI. It runs offline.
Week 10 - Mar 3-9, 2026
Bedrock AgentCore Policy hits GA, mixing LLM authorship with Cedar policy-as-code, the first AWS service to do that at scale. IAM gets a simplified role-creation flow with inline panels. AWS adds DESC 2026 certification for the UAE.
Week 21 - May 18-24, 2026
Security Hub learns to find identity risk that no one is using: unused IAM permissions, roles, and credentials, measured against 90 days of real activity. The Extended plan grows to 21 partners across 9 categories. Secrets Manager Agent picks up pre-fetching and cross-account role assumption, and Amazon Inspector Classic reaches end of support.
Week 34 - Aug 17-23, 2026
Truffle Security reports that more than 9,300 of 10,616 re-tested leaked AWS keys still authenticate, 768 of them with full administrator or root access, some five years after first appearing publicly. Security Hub Extended adds Supply Chain Security as its tenth category. AWS also ships seven security bulletins this week, mostly across OpenSearch Dashboards and FreeRTOS-Kernel.
Week 36 - Aug 31 - Sep 6, 2026
JetBrains concludes its investigation into a three-week breach of its Cadence CI/CD service, confirming attackers compromised AWS IAM users and credentials and accessed files in JetBrains-owned S3 buckets, alongside PyCharm source code and user data. Four new AWS security bulletins close the month, and AWS opens beta registration for its new AI Business Strategist certification.
Week 37 - Sep 7 - Sep 13, 2026
No major breach this week, but a busy one for AWS security bulletins: five new CVEs, led by a critical OS command injection in postgres-mcp-server that turns its read-only safeguard into full command execution. Also patched: a mysql-mcp-server read-only bypass, an SSM Session Manager SSRF exposing temporary IAM credentials, an XXE in the AWS Advanced JDBC Wrapper, and a denial-of-service in the AWS SDK for Go v2.
Week 39 - Sep 21 - Sep 27, 2026
A setup-only Lambda function in the Amazon Connect Salesforce integration let any principal allowed to invoke it perform AWS operations their own IAM permissions would deny. Also patched: a Kiro IDE flaw that could let a crafted repository, opened as an untrusted workspace, cause the agent to modify its auto-loaded global configuration, a code-execution bug in the pgcollection PostgreSQL extension, and a single-packet shutdown in s2n-quic. On the launch side, AWS Network Security Manager reached general availability.
Need Help with AWS Security?
Our AWS security experts can help you implement best practices across all these topics.
Contact Us