Tagged “iam”
4 posts
The Capital One breach: an SSRF bug into 100M records
A misconfigured WAF and an SSRF bug let an attacker reach the AWS metadata service and steal role credentials — exposing 100M+ Capital One records.
securityawsiamcloud
Ditch IAM access keys: GitHub Actions OIDC to AWS
A step-by-step guide to replacing long-lived IAM access keys in GitHub Actions with short-lived OIDC credentials, including the trust policy gotchas that bite people.
awsgithubiamtutorial
IAM Identity Center: kill per-account IAM users for good
A practical guide to setting up AWS IAM Identity Center for multi-account SSO with Terraform, including the SCIM sync and provisioning-delay gotchas that catch people.
awsiamssotutorial
Scoping IAM Policies with Tag, IP, and MFA Conditions
A practical guide to IAM condition keys — aws:ResourceTag, aws:SourceIp, and MFA presence — with JSON examples and the Deny-with-exceptions gotchas that trip people up.
awsiamsecuritytutorial