Apps can now impersonate human access to AWS via IAM Identity Center

by Aidan Steele

AWS shipped the ability for server-side apps to assume roles on behalf of their own users through IAM Identity Center, and Aidan reverse-engineered it the same day. His field notes cover what the CloudTrail events actually look like, whether it's ready to turn on today, and the sharp edges the docs skip. If you've ever handed an internal tool a superset of everyone's permissions and then bolted your own authz on top, this is the feature you've been waiting for - along with the caveats to understand before you flip it on.

AWS Forensics: what you need to know

by Nathanael Ndong

Nathanael has written the AWS incident-response primer you wish every forensic analyst had before their first cloud breach. It walks through the account and identity model, then zeroes in on where the evidence actually lives - and where it doesn't, from CloudTrail's 90-day default retention to data events that stay off until you enable them. A grounded field guide to reconstructing what an attacker did, from recon and IAM backdoors to Lambda persistence.

Why I Keep Recommending Amazon GuardDuty

by Sena Yakut

I feature Sena's content pretty regularly because she writes from experience and doesn't overcomplicate things. In this post she makes the case for GuardDuty as the first detection service she reaches for on almost any AWS environment, tracing how it grew from crunching CloudTrail, VPC Flow Logs and DNS logs into today's much broader sensor. It's a practical, experience-driven tour of what the service catches for near-zero setup effort, and the gaps you still have to close yourself. I'm not a fan of the GuardDuty UX but the service works, has improved dramatically recently, and is infinitely better than no breach detection which is what most companies have.