Shift-Left Security with Amazon Inspector Code Security by Sena Yakut

I love this post because you can copy and paste the enclosed code, follow the instructions, and have a working infrastructure-as-code scanning pipeline up and running in under 30 minutes. It's something every company eventually needs to do, but it often causes much wasted effort and heartache. Sena did what AWS should have done and made the process trivial.

Investigate Your Own AWS Attack with Athena by Rich Mogull

We love Rich. His newest SLAW lab spins up a booby-trapped CloudFormation stack that deliberately leaks an IAM key and triggers a simulated attack from his account. Your job is to investigate the incident using CloudTrail and Athena, gauge the blast radius, and tidy up the lab before heading back to reality.

Unmasking Lambda's Hidden Threat - When Your Bootstrap Becomes a Backdoor by Guillermo Fernandez Cano and Sergio Jimenez

This is a cool variation of existing persistence techniques for Lambda that abuse language-specific bootstrap code. If the target is using a custom runtime, the authors claim modifying the bootstrap file can survive legitimate code deployments. Pretty sweet, if true.