CloudTrail Root Account Monitor — Alert on Root API Usage via Lambda
Problem Statement The AWS root account bypasses all IAM policies and has unrestricted access to everything in the account — including …
Jan 20, 2025
Read more
Cloudtrail
4 articles
Generate Least-Privilege IAM Policy from CloudTrail Logs
Problem Statement Your application role has PowerUserAccess (5,000+ allowed actions), but in 30 days of production usage it only calls 12 …
Jan 20, 2025
Read more
EC2 Instance Communicating with Malicious IP — Incident Response
The Problem A running EC2 instance may be compromised — malware installed, data being exfiltrated, or the instance being used as a pivot to …
Jan 20, 2025
Read more
Developer Pushed AWS Credentials to Public GitHub — Incident Response
The Problem Leaked AWS credentials are one of the most dangerous security incidents. Attackers have automated scrapers that monitor GitHub …
Jan 20, 2025
Read more