Monday,
May 12, 2025

🥖 Palette Cleanser

Hello weary cloud warriors,

Now that all the conference excitement is definitely over for the year, we can all relax and play a nice round of the The Cloud Hunting Games. The goal of this CTF is to identify the steps taken by the attacker and trace them back to the initial access point.

And if you still have time after that, I would really appreciate it if you could share this issue with one colleague who hasn't seen ASD before. AWS security is my passion, but I can't do it without your support.

<3
Your secret nerd crush, DG.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • EKS vs. GKE — Security by Jason Umiker

    Some people like to inflict pain on themselves by using Kubernetes. Jason likes a special kind of pain — doing it across multiple cloud providers' managed services. This post is great if you are trying to decide between AWS’ Elastic Kubernetes Service (EKS) and GCP’s Google Kubernetes Engine (GKE), but even better if you are trying to translate your existing security knowledge from one platform to the other.

  • PEP and PDP for Secure Authorization with AVP and ABAC by Jimmy Dahlqvist

    You may not know you need this post, and the previous 1st and 2nd installments, because there are too many damn acronyms. So allow me to translate from Jimmy to English.

    • PEP = Policy Enforcement Point
    • PDP = Policy Decision Point
    • AVP = Amazon Verified Permissions
    • ABAC = Attribute-Based Access Control

    So basically, if you have a system with complex authorization requirements that you want to implement in a standard and repeatable way, this might be an option for you. Note: much brainpower is required.

  • What Analyzing Hundreds of Thousands of Cloud Environments Taught Us About Data Exposure by Wiz

    Some light reading to finish. It isn't Wiz's best or most comprehensive work, but it still has some interesting nuggets. For example, "72% of cloud environments have publicly exposed PaaS databases that lack sufficient access controls." I wonder if buckets that host websites are included in that list and blow out the numbers? [Wiz has reached out and said they aren't] Anyway, enjoy the stats if you want to show your boss that your cloud environment isn't THAT bad, relatively speaking.

Bonusii:

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Pleri is your AI-powered teammate built to boost your cloud security team — faster reactions, smarter actions, no extra headcount. Meet Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.