Tagged “iam”
8 posts
The IAM Permissions That Quietly Grant Admin, One Hop at a Time
A handful of ordinary-looking AWS IAM permissions combine into full account takeover — the policy chains attackers look for first, and how to close them.
The Azure SRE Agent bug that let attackers borrow its identity
CVE-2026-62830 broke the on-behalf-of flow in Microsoft's autonomous ops agent, letting a low-privileged attacker inherit every permission the agent had across your Azure estate.
The Okta breach that hit BeyondTrust, 1Password, and Cloudflare
A stolen support-system session cookie let attackers pull HAR files full of live session tokens from Okta, turning a single compromise into breaches at at least four downstream customers.
SCARLETEEL and the case against trusting Terraform state
A cloud intrusion pivoted through a plaintext AWS key sitting in an exposed terraform.tfstate file — why state was never designed to be a secret store.
The Capital One breach: an SSRF bug into 100M records
A misconfigured WAF and an SSRF bug let an attacker reach the AWS metadata service and steal role credentials — exposing 100M+ Capital One records.
Ditch IAM access keys: GitHub Actions OIDC to AWS
A step-by-step guide to replacing long-lived IAM access keys in GitHub Actions with short-lived OIDC credentials, including the trust policy gotchas that bite people.
IAM Identity Center: kill per-account IAM users for good
A practical guide to setting up AWS IAM Identity Center for multi-account SSO with Terraform, including the SCIM sync and provisioning-delay gotchas that catch people.
Scoping IAM Policies with Tag, IP, and MFA Conditions
A practical guide to IAM condition keys — aws:ResourceTag, aws:SourceIp, and MFA presence — with JSON examples and the Deny-with-exceptions gotchas that trip people up.