2068
All about cloud security Contacts: @AMark0f @dvyakimov About DevSecOps: @sec_devops
🔶 Implementing just-in-time privileged access to AWS with Microsoft Entra and AWS IAM Identity Center
By using security groups in Entra and mapping them to permission sets in IAM Identity Center, you can automate the provisioning and deprovisioning of privileged access based on defined policies and approval workflows.
https://aws.amazon.com/ru/blogs/security/implementing-just-in-time-privileged-access-to-aws-with-microsoft-entra-and-aws-iam-identity-center/
#aws
👩💻 Lost in Resolution: Azure OpenAI's DNS Resolution Issue
Unit 42 researchers discovered an issue with Azure OpenAI's Domain Name System (DNS) resolution logic that could have enabled cross-tenant data leaks and meddler-in-the-middle (MitM) attacks.
https://unit42.paloaltonetworks.com/azure-openai-dns-resolution/
#azure
👩💻 Azure Arc - C2aaS
Post exploring Azure Arc's overlooked C2aaS potential: attacking and defending against its usage and exploring use cases for Red Teams.
https://blog.zsec.uk/azure-arc-c2aas/
#azure
🔶 boto3-refresh-session
A simple Python package for refreshing AWS temporary credentials in boto3 automatically.
https://github.com/michaelthomasletts/boto3-refresh-session
#aws
🔶 How to set up and track SLAs for resolving Security Hub findings
Step-by-step instructions for tracking Security Hub findings in each severity category against service-level agreements (SLAs) through visual dashboards.
https://aws.amazon.com/ru/blogs/security/how-to-set-up-and-track-slas-for-resolving-security-hub-findings/
(Use VPN to open from Russia)
#aws
🔴 Removing GitHub PATs and Private Keys From Google Cloud: Extending Token Server to Google Cloud
This article introduces the technologies, challenges, and solutions behind extending Token Server and migrating workloads on Google Cloud to use short-lived credentials.
https://engineering.mercari.com/en/blog/entry/20241203-token-server-google-cloud/
#gcp
🔴 Hunting for Bucket Traversals in Google's Client Libraries
A bucket traversal vulnerability arises when an application mishandles user input while interacting with cloud storage, allowing unauthorized access to storage objects.
https://jdomeracki.github.io/2025/05/04/hunting_for_bucket_traversals/
#gcp
🔶 Root in prod: The most important security analysis you will never do on your AWS accounts
This article outlines steps for identifying AWS accounts, determining which ones are truly production, and analyzing access levels, including finding users and roles with AdministratorAccess.
https://www.plerion.com/blog/root-in-prod
#aws
🔶 Implementing safety guardrails for applications using Amazon SageMaker
Post explaining guardrail implementation strategies.
https://aws.amazon.com/ru/blogs/security/implementing-safety-guardrails-for-applications-using-amazon-sagemaker/
(Use VPN to open from Russia)
#aws
👩💻 Does AZNFS SUID your needs? A Path to Root Privilege Escalation on Azure AI and HPC
An Azure utility for mounting Azure Storage that comes preinstalled on Azure HPC/AI images allowed an unprivileged user on a Linux machine with this utility installed to escalate their privileges to root.
https://www.varonis.com/blog/aznfs-root-privilege-escalation-on-azure
(Use VPN to open from Russia)
#azure
🔶 Use an Amazon Bedrock powered chatbot with Amazon Security Lake to help investigate incidents
How to deploy a security chatbot with a GUI and a serverless backend powered by an Amazon Bedrock agent that incorporates existing playbooks to investigate or respond to a security event.
https://aws.amazon.com/ru/blogs/security/use-an-amazon-bedrock-powered-chatbot-with-amazon-security-lake-to-help-investigate-incidents/
(Use VPN to open from Russia)
#aws
🔶 Configuring Model Context Protocol (MCP) with Amazon Q CLI
This post will walk you through everything you need to know to get Amazon Q CLI up and running to use MCP.
https://blog.beachgeek.co.uk/getting-started-mcp-amazon-q-cli/
#aws
🔶 The Cloud Hunting Games
A new CTF by Wiz.
https://www.cloudhuntinggames.com/
#aws
🔴 Tag Your Way In: New Privilege Escalation Technique in GCP
This post introduces a novel privilege escalation technique in Google Cloud Platform (GCP) that exploits IAM Conditions in combination with tagBindings.
https://www.mitiga.io/blog/tag-your-way-in-new-privilege-escalation-technique-in-gcp
#gcp
🔶 Shadow Roles: AWS Defaults Can Open the Door to Service Takeover
Post walking through multiple real-world scenarios, including how a malicious Hugging Face model can escalate privileges, how limited Glue access can impact other services, and how a single default role can ultimately lead to full control of an AWS account.
https://www.aquasec.com/blog/shadow-roles-aws-defaults-lead-to-service-takeover/
#aws
🔴 The Cost of a Call: From Voice Phishing to Data Extortion
UNC6040 uses vishing to impersonate IT support, deceiving victims into granting access to their Salesforce instances.
https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion
#gcp
🔶 CloudTrail Logging Evasion: Where Policy Size Matters
Permiso uncovered a subtle yet critical logging evasion vulnerability within AWS environments - mainly the differing size limitations of individual AWS CloudTrail logs versus the actual content being logged. By exploiting whitespace and other syntactic quirks, an attacker can create valid IAM policies that effectively bypass CloudTrail logging.
https://permiso.io/blog/cloudtrail-logging-evasion-where-policy-size-matters
#aws
👩💻 proxyblob
SOCKS5 proxy tool that uses Azure Blob Storage as a means of communication.
https://github.com/quarkslab/proxyblob
#azure
🔴 Safer automated deployments with new Cloud Deploy features
New automations in the Cloud Deploy continuous delivery platform help keep production environments reliable and up-to-date.
https://cloud.google.com/blog/products/devops-sre/new-cloud-deploy-features-for-automated-deployments/
#gcp
🔴 Mark Your Calendar: APT41 Innovative Tactics
Post which analyzes the malware delivery methods, technical details of the malware attack chain, discuss other recent APT41 activities, and share indicators of compromise (IOCs) to help security practitioners defend against similar attacks.
https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics/
#gcp
👩💻 Microsoft extends Zero Trust to secure the agentic workforce
Microsoft introduced Microsoft Entra Agent ID, which extends identity management and access capabilities to AI agents.
https://www.microsoft.com/en-us/security/blog/2025/05/19/microsoft-extends-zero-trust-to-secure-the-agentic-workforce/
#azure
🔶 PowerUserAccess vs. AdministratorAccess from an attacker's perspective
The article highlights the dangers of using the AWS managed policy PowerUserAccess in complex environments by sharing an attacker's perspective on the matter.
https://www.offensai.com/blog/poweruseraccess-vs-administratoraccess-from-an-attacker-perspective
(Use VPN to open from Russia)
#aws
🔶 TrailAlerts
TrailAlerts is a AWS-native, serverless cloud-detection tool that lets you define simple rules as code and get rich alerts about events in AWS.
https://github.com/adanalvarez/TrailAlerts
#aws
🔶 AI lifecycle risk management: ISO/IEC 42001:2023 for AI governance
Post explaining how ISO/IEC 42001 enables effective AI governance, review the risk management requirements, and explore how you can use threat modeling as a practical technique to meet those expectations.
https://aws.amazon.com/ru/blogs/security/ai-lifecycle-risk-management-iso-iec-420012023-for-ai-governance/
(Use VPN to open from Russia)
#aws
🔶 Tales from the cloud trenches: The Attacker doth persist too much
A cloud attack targeting Amazon SES and persistence via AWS Lambda, AWS IAM Identity Center and AWS IAM.
https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-the-attacker-doth-persist-too-much/
#aws
🔴 What's new in IAM, Access Risk, and Cloud Governance
At Google Cloud Next, Google announced multiple new capabilities in their IAM, Access Risk, and Cloud Governance portfolio, including: IAM, Access Risk products including VPC Service Controls, Context-Aware Access and Identity Threat Detection and Response, Cloud Governance with Organization Policy Service, and Resource Management.
https://cloud.google.com/blog/products/identity-security/whats-new-in-iam-access-risk-and-cloud-governance/
#gcp
🔶 S3 bucket name squatting
Post sharing findings on four AWS services - Amazon Athena, AWS Elastic Beanstalk, AWS CodePipeline, AWS Config - and the implications of bucket name squatting.
https://www.reply.com/spike-reply/en/blog/s3-bucket-name-squatting
#aws
👩💻 The Invisible Enemy: Unmasking Microsoft 365's Logging Blind Spots
Blog dissecting the limitations of Microsoft's activity logs, walking through real-world simulations using the msInvader tool, and highlighting what gets seen and what silently slips through the cracks.
https://www.abstract.security/blog/the-invisible-enemy-unmasking-microsoft-365s-logging-blind-spots
#azure
🔶 Preventing Cross-Service Confused Deputy Attacks in AWS ELB Logging
Post highlighting the inconsistency in AWS services regarding S3 bucket permissions and encryption methods.
https://tomclancy.me/2025/04/24/preventing-cross-service-confused-deputy-attacks-in-aws-elb-logging.html
#aws
🔶 AWS Built a Security Tool. It Introduced a Security Risk
The «Account Assessment for AWS Organizations» tool, designed to audit resource-based policies for risky cross-account access, ironically introduced cross-account privilege escalation risks due to flawed deployment instructions.
https://www.token.security/blog/aws-built-a-security-tool-it-introduced-a-security-risk
#aws