Monday,
February 23, 2026

🥖 Palette Cleanser

We all complain when the internet is on fire, but when it's not, I complain there's not enough to write about. :/

ACM public certificates now max out at 198 days (down from 395), getting ahead of the CA/Browser Forum mandate requiring ≤200-day validity effective March 15, 2026. In practice, nothing changes for you. ACM handles renewal automatically 45 days before expiry. Thanks Ivo Pinto for spotting this.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

  • Locking down AWS principal tags with RCPs and SCPs by Aidan Steele

    You've built tag-based access controls, but what stops a dev team from slapping AllowAccessKeys=true on their own roles? Aidan shows how to combine RCPs (to protect the tagging role itself) with SCPs (to enforce tag requirements) so your principal tags actually mean something. The worked example covers restricting long-lived credential creation to specific teams.

  • Don't expose yourself in public - let AWS error messages do it for you by Chef Daniel Grzelak

    AWS quietly shipped friendlier IAM errors in late January that tell you exactly which policy layer denied your request. It turns out you can weaponize this: apply a deny-all session policy, call the API, and if your session policy is the blocker, the resource policy would have allowed anonymous access. Years of mutation-based recon techniques just got deprecated.

  • How Security Tool Misuse Is Reshaping Cloud Compromise by Sayali Warekar

    TruffleHog and friends were built to find your leaked secrets before attackers do. Now attackers are using them too. The playbook is brutally efficient: discover creds, validate with sts:GetCallerIdentity, enumerate IAM permissions, exfiltrate. The article focuses on recent campaigns, including Shai-Hulud (a self-replicating worm across 500+ NPM packages exposing ~14k secrets), and shows why long-lived keys remain the gift that keeps on giving.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

Pleri logo

Meet Pleri: your AI-powered cloud security teammate. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

    No resource updates this week.

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

    No bulletins this week.

🚬 Security documentation changes

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.