Articles on IAM authentication, data encryption, WAF, compliance, and zero trust on AWS
Detect unused permissions on IAM roles based on CloudTrail and automatically generate least-privilege policies. This article explains external access detection and how to build custom policy checks into CI/CD.
This article explains free issuance of public certificates with ACM, DNS validation, automatic renewal, and deployment to ALB / CloudFront.
An explanation of isolated processing of sensitive data with AWS Nitro Enclaves. This article introduces cryptographic attestation, KMS integration, and use cases for PII processing / encryption key management.
This article explains how to centrally manage WAF rules, Security Groups, and Network Firewall policies across Organizations and maintain an organization-wide security baseline through automatic application to new accounts.
Explains dedicated management of cryptographic keys with AWS CloudHSM. Covers exclusive use of a single-tenant HSM, direct control through PKCS#11 and JCE, key custody, the selection criteria versus KMS, migration to the hsm2m.medium generation, and TLS offload and Oracle TDE integration.
Automatically scans EC2 instances, ECR container images, and Lambda functions for vulnerabilities and prioritizes them with CVE-based risk scores. Explains how agentless scanning is also achieved through integration with the Systems Manager agent.
This article explains how KMS master keys are stored inside FIPS 140-2 certified HSMs, how envelope encryption provides double protection for data keys, and the internal workings of key rotation.
Eliminates VPNs and achieves zero trust access that verifies user identity and device security posture every time. It introduces fine-grained control with Cedar policies.
An explanation of VPN-less zero trust access using AWS Verified Access. Identity provider integration, device trust, policy-based access control, and a comparison with traditional VPNs are introduced.
Learn about TLS/SSL certificate issuance, automatic renewal, and deployment using AWS Certificate Manager (ACM). Covers integration with CloudFront, ALB, and API Gateway, DNS validation, and Private CA usage.
Learn how to achieve disaster recovery with multi-region replication and build centralized management from a security account using cross-account access.
Automatically rotate RDS and Aurora passwords with Lambda functions and seamlessly retrieve secrets from applications using the SDK caching library. Also covers when to use Parameter Store instead.
Detect scrapers and automation tools with Bot Control, and prevent credential stuffing with ATP. Includes user experience design for challenges and CAPTCHA.
Achieve FIPS 140-3 Level 3 compliant key management with dedicated HSM instances. Learn when to choose CloudHSM over KMS and how to integrate both through KMS custom key stores.
Learn about user authentication with Cognito User Pools, AWS resource access with Identity Pools, and social login integration.
Apply code signing to Lambda functions and container images, enforce signature verification in CI/CD pipelines, and handle compromises through signature revocation.
Learn how GuardDuty detects threats, classifies findings, and integrates with Security Hub for incident response.
Build a private certificate authority and automatically issue mTLS certificates for internal service-to-service communication. Learn about certificate lifecycle management and CRL design.
Learn how to externalize authorization logic from application code using the Cedar policy language and implement token-based authorization decisions with Cognito integration.
Control VPC traffic with stateful/stateless rules and domain filtering. Learn how to leverage Suricata-compatible rules and managed rule groups.
Learn about Security Lake's automatic aggregation of CloudTrail, VPC Flow Logs, and Route 53 logs, OCSF normalization, and integration with subscribers.
Learn how to retrieve SOC, PCI DSS, and ISO audit reports on demand and apply BAA and GDPR DPA agreements across your entire AWS Organizations structure.
This article explains how CloudTrail records AWS API calls, the differences between management events and data events, SQL analysis with CloudTrail Lake, and forensic investigation techniques when a security incident occurs.
Set up AWS Managed Microsoft AD and design trust relationships with on-premises AD. This article covers hybrid identity management through integration with WorkSpaces, RDS, and FSx.
Learn how to automate audit evidence collection with AWS Audit Manager. This guide covers automated assessments based on frameworks such as SOC 2, PCI DSS, and GDPR, centralized evidence management, and audit report generation.
Learn why the EC2 Instance Metadata Service endpoint 169.254.169.254 is a link-local address, the history of SSRF exploitation, and how IMDSv2's token-based authentication came to be.
Learn how to design and implement a user authentication foundation using Amazon Cognito, including building authentication flows with user pools, identity pools, and external identity provider federation.
Learn how to process sensitive data in the isolated environment of Nitro Enclaves, and control encryption key access through KMS integration and attestation.
Learn how Payment Cryptography manages payment cryptographic keys, encrypts and decrypts PIN blocks, and achieves PCI DSS compliance.
A trivia-style exploration of why AWS account IDs are 12-digit numbers, the design intent embedded in the ARN structure, and the security considerations around what can be inferred from an account ID.
We explain why the AWS root user holds privileges that cannot be restricted by IAM, list the operations only the root user can perform, cover MFA setup methods, and describe the lockdown strategy using Organizations' centralized root access management.
Learn practical data privacy protection techniques combining Amazon Macie's automated sensitive data discovery in S3 with Amazon GuardDuty's threat intelligence. This article covers comprehensive security measures from identifying personal information to real-time threat detection.
Learn about DDoS protection with AWS Shield Standard and Shield Advanced. This guide covers integration with CloudFront, Route 53, and ALB, combining with WAF, and cost protection features.
Learn about investigating GuardDuty findings with Detective, entity profiles, and leveraging behavior graphs.
Learn how to integrate Active Directory with the cloud using AWS Directory Service. This article covers how to choose between AWS Managed Microsoft AD, AD Connector, and Simple AD, and how to integrate with WorkSpaces, RDS, and FSx.
Learn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.
A step-by-step explanation of how IAM evaluates requests to allow or deny them, covering the priority of implicit deny, explicit allow, and explicit deny, as well as intersection logic for SCPs, permission boundaries, and session policies.
Achieve single sign-on for multi-account environments and control access levels to each account with permission sets. Covers external IdP integration and ABAC usage.
Learn how Amazon Macie automatically discovers sensitive data (PII, financial information, credentials) in S3 buckets and how to build a data protection strategy based on the findings.
Learn about Macie's sensitive data discovery for S3 buckets, custom data identifiers, and Security Hub integration.
AWS Payment Cryptography is a managed HSM service purpose-built for the payment industry, providing PCI DSS compliant encryption and tokenization in a serverless model. This article takes a deep dive into the technical mechanisms of payment encryption, including PIN block generation, DUKPT key management, and how it differs from CloudHSM.
Aggregate findings from GuardDuty, Inspector, and Macie using ASFF, quantify your security score through automated security standard evaluations, and set up automated remediation via EventBridge.
Learn how to use Amazon Detective for security incident investigation and threat analysis. This guide covers the detection-to-investigation workflow with GuardDuty integration and root cause identification through graph-based analysis.
Learn about unified security monitoring with AWS Security Hub and automated threat detection through GuardDuty integration. This guide covers visualizing compliance with security best practices and security governance for multi-account environments.
Understand the differences between Standard's free L3/L4 protection and Advanced's L7 support with SRT assistance. Learn about cost protection and proactive engagement.
A cryptographic deep dive into the 4-step SigV4 signing process (canonical request creation, string-to-sign construction, signing key derivation, signature calculation) used for AWS API authentication, plus an overview of SigV4A and presigned URLs.
Learn how to design and operate vulnerability assessment and threat detection using Amazon Inspector and Amazon GuardDuty.