Monday,
March 24, 2025

🥖 Palette Cleanser

The big news in cloud security this week was that Google lost the game of chicken with Wiz to "strengthen multicloud security". It's how the Luka Dončić trade should've played out but didn't. Last year Google offered $23 billion which wasn't enough billion for the Wiz board. Maybe there was a clerical error and they accidentally got the digits backwards because this week $32 billion turned out to be just the right amount of billion. I hope all my Wiz friends got that sweet accelerated vesting with lots of zeros on the end. <3

Separate from the usual menu I've included three in-depth analyses of the deal from three different perspectives:

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • How to use the new CloudTrail network activity events for AWS VPC Endpoints by Rami McCarthy, Scott Piper

    VPC Endpoints let stuff running inside a VPC talk to supported AWS services without going out to the internet. In February AWS added network activity events for VPC endpoints to CloudTrail. Rami and Scott give us some ideas on how to use these logs to safely develop and manage VPC Endpoint policies, and detect data exfiltration. Both authors have written highly prescriptive technical articles in the past, and I wish they added a bit more of that vibe to this one.

  • Beyond Configuration Perfection: Redefining ‘Cloud Security’ by Kat Traxler

    This isn't about any single cloud provider like AWS. It's included because it highlights mistakes we all make in decision-making, often based on what we believe to be objective data. One trap from the article that I see organizations fall into all the time is failing to consider opportunity cost. “When excessive brain power is dedicated to misconfiguration remediation and least-privilege, they may have less capacity for threat detection and incident response, security automation and orchestration, and governance and risk management.” Tools and metrics are here to serve us—not the other way around.

  • AWS CloudWatch log ingestion to Microsoft Sentinel by Paul Schwarzenberger

    We love a good niche at this newsletter, and this one’s no exception. Paul tested the integration between AWS CloudWatch and Microsoft Sentinel and found that it wasn’t practical for handling hundreds of CloudWatch log groups across multiple AWS accounts. In this article, he explains—code included—how he solved the problem with some help from Microsoft. And if you happen to live in this niche, now you can solve it too.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Plerion is building an AI cloud security engineer that works like another member of your team.

Want to be a design partner? Let's do it together!

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

    No new CVEs.

📺 AWS Security Bulletins

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.