Tagged “aws”
36 posts
Cloud roundup: macOS Screen Sharing bug now under attack
A patched macOS Screen Sharing flaw is being exploited to plant crypto miners, a Windows Defender bypass has no fix yet, and EC2 gets built-in app health checks.
Cutting NAT gateway costs with VPC endpoints that actually help
How gateway and interface VPC endpoints replace NAT gateway traffic for AWS API calls, what they cost instead, and which traffic still has to go through NAT.
Cloud roundup: S3 finally names the policy that denied you
AWS S3 access-denied errors now name the exact policy ARN, Client VPN gets a scriptable CLI, and OpenAI ships authorized offensive-security models on Bedrock.
Service spotlight: Amazon Cognito user pools vs identity pools
Amazon Cognito is two different services wearing one name — user pools for authentication, identity pools for AWS credentials — and the pricing tiers that trip teams up.
The Capital One breach: an SSRF bug into 100M records
A misconfigured WAF and an SSRF bug let an attacker reach the AWS metadata service and steal role credentials — exposing 100M+ Capital One records.
Cloud roundup: 153GB LiteLLM breach exposes cloud secrets
A leaked 153GB credential archive ties March's LiteLLM breach to 2,488 orgs including AWS and Cisco, plus new EKS control-plane and OpenSearch pricing changes.
Cloud roundup: Metabase CVSS 10 SQLi confirmed exploited
A CVSS 10 Metabase SQLi is now confirmed exploited and in CISA KEV, plus an exploited Cisco ASA/FTD DoS bug and Microsoft's Patch Tuesday zero-day.
Cloud roundup: New ransomware exploits N-central bug
Microsoft ties new StormEncryptor ransomware to an N-able N-central auth bypass, plus new AWS EC2 health checks and DRS UEFI support for Linux failovers.
Cloud roundup: LoadMaster RCE hits its KEV deadline today
A critical unauthenticated Progress LoadMaster RCE hits its federal KEV remediation deadline today, plus a CVSS 10 Metabase zero-day and AWS supply chain security news.
CI/CD for a static site: build, sync, and invalidate
How to structure a GitHub Actions pipeline that builds a static site, syncs it to S3 with correct cache headers, and invalidates CloudFront without overpaying.
CloudFront invalidations without nuking your AWS bill
How CloudFront invalidation pricing actually works, why fingerprinted asset filenames let you skip it almost entirely, and when surgical invalidation is still required.
Ditch IAM access keys: GitHub Actions OIDC to AWS
A step-by-step guide to replacing long-lived IAM access keys in GitHub Actions with short-lived OIDC credentials, including the trust policy gotchas that bite people.
IAM Identity Center: kill per-account IAM users for good
A practical guide to setting up AWS IAM Identity Center for multi-account SSO with Terraform, including the SCIM sync and provisioning-delay gotchas that catch people.
Diagnosing and fixing Lambda cold starts that matter
A practitioner guide to measuring Lambda Init Duration, trimming package bloat, and deciding when provisioned concurrency is worth its always-on cost.
Scoping IAM Policies with Tag, IP, and MFA Conditions
A practical guide to IAM condition keys — aws:ResourceTag, aws:SourceIp, and MFA presence — with JSON examples and the Deny-with-exceptions gotchas that trip people up.
Terraform S3 native locking: kill your DynamoDB table
How to configure Terraform S3 backend state locking without DynamoDB using use_lockfile, plus the safe migration path from an existing lock table.
Service spotlight: Amazon Bedrock and its guardrails feature
What Bedrock buys you over calling a model provider directly, how the Guardrails feature filters content and PII, and where per-token pricing surprises show up.
Service spotlight: Amazon EventBridge beyond Lambda glue
What EventBridge actually buys you over SNS/SQS point-to-point wiring, how schema discovery and archive/replay work, and where rule limits bite.
Service spotlight: Amazon SQS queue depth, DLQs, and visibility
The SQS mistakes that show up in production — visibility timeout mismatches, DLQ redrive without a plan, and the alarms worth setting on day one.
Service spotlight: Aurora Serverless v2 without the v1 cold starts
How Aurora Serverless v2 scales capacity in fine-grained ACUs without pausing, where it still costs more than provisioned Aurora, and its real limits.
Service spotlight: AWS AppSync and its resolver-cost model
What managed GraphQL on AppSync buys over a hand-rolled Apollo server, how VTL and JS resolvers bill, and where subscriptions change your architecture.
Service spotlight: AWS Backup replaces per-service snapshot scripts
How AWS Backup centralizes EBS, RDS, DynamoDB, and EFS backup policy into one plan, and what it still leaves you to configure yourself.
Service spotlight: AWS Config for compliance-as-code and drift detection
How AWS Config records resource configuration history and evaluates it against rules continuously, and why it pairs with — not replaces — Terraform.
Service spotlight: AWS Fargate and its per-task pricing surprises
What you actually give up going serverless with Fargate over EC2-backed ECS, how per-task vCPU/memory billing adds up, and where Fargate Spot fits.
Service spotlight: AWS Step Functions for real workflows
When AWS Step Functions earns its keep over a pile of Lambda glue code, where its per-transition pricing bites, and a Map state trick worth knowing.
Service spotlight: CloudFront Functions vs Lambda@Edge
Picking between the two edge-compute options on CloudFront — runtime limits, latency, pricing, and which one actually fits a URL rewrite versus an origin call.
Service spotlight: querying years of audit history with CloudTrail Lake
How CloudTrail Lake lets you SQL-query months of API activity without standing up Athena and Glue yourself, and where its pricing model changes the calculus.
Service spotlight: Kinesis Data Streams, shards, and when SQS was simpler
What shards and fan-out actually buy you over SQS, where consumer scaling gets tricky, and the honest case for not reaching for Kinesis by default.
Service spotlight: cheap DNS-level failover with Route 53 health checks
How Route 53 health checks and failover routing build automatic DNS failover without a load balancer in front, and where DNS TTLs limit how fast it actually is.
Service spotlight: when S3 Intelligent-Tiering beats hand-rolled lifecycle rules
How Intelligent-Tiering automates storage-class transitions by access pattern, its monitoring fee, and when a plain lifecycle policy is still cheaper.
Service spotlight: wiring automatic rotation into Secrets Manager
How Secrets Manager rotation actually works end to end with the Lambda rotator pattern for RDS, and the failure modes that leave a secret half-rotated.
Service spotlight: SSH-less, bastion-less EC2 access with SSM
How Systems Manager Session Manager replaces bastion hosts and open SSH ports with IAM-authenticated, logged shell access, and where the agent still trips people up.
Service spotlight: running an AWS Well-Architected Tool review
What the Well-Architected Tool actually surfaces when you run a workload through it, where its generic questions fall short, and how to act on the output.
CVE-2026-16812: a CVSS 10 hole in your SD-WAN control plane
An unauthenticated command injection in Arista VeloCloud Orchestrator On-Prem lets attackers pivot from one exposed console to every edge device it manages.
The 198M-voter S3 leak that still explains most breaches
A 2017 misconfigured S3 bucket exposed 198 million voter records, and the same public-bucket misconfiguration still causes new breaches every year.
Cloud roundup: unauthenticated TeamCity RCE now in KEV
A critical unauthenticated TeamCity RCE hits the CISA KEV list, plus Tomcat and Langflow exploitation and a nice AWS Lambda bandwidth bump.