Here's my seventh or eighth attempt at a blog. It's mostly going to be my experimentation with using AWS (Amazon Web Services, not Aidan William Steele).
AWS just [announced][announcement] that S3 event notifications now include the system-generated tags attached to the bucket responsible for the notification. This sounds like a small change, but it will enable some useful patterns. It's also at least the third example of an AWS service offering value-add through tag enrichment. The release notes were a bit light on details, so I verified for…
AssumeRoleWithWebIdentity seems to have a new, barely-documented, policy condition key. It's called sts:RoleAuthorizedByIdp and if you're anything like me (my condolences), that name will pique your interest. It's not super useful today (unless you're running an OIDC IdP), but its utility will grow as adoption improves over time. So here's what I've learned so far.
Earlier today, AWS IAM Identity Center [launched][launch] the ability for server-side applications to assume roles on behalf of their users. This is a big deal, I've wanted this exact kind of functionality for years. The docs are pretty sparse on how it works and what the events look like in CloudTrail, so here are my field notes, recommendations on whether you should use it today and feature…
AWS launched Lambda MicroVMs [earlier today][launch]. They're quite cool, and I imagine they'll become quite popular quite quickly. Here are some notes on things I've discovered about them today.
Amazon has deprecated CloudTrail Lake as of 1st June 2026 for new customers. I assume this is due to lack of uptake. I never got around to properly using it, and I'm a CloudTrail fan! So I can only imagine not many others used it. In its place, Amazon [recommends][ct-doc] that we 'explore CloudWatch'. I explored CloudWatch and came away quite disappointed.
I was looking at the execution history for a Step Functions state machine that is triggered daily by an EventBridge Scheduler schedule. The execution names caught my eye — they look like UUIDs, they're not UUIDv7, but there's clearly a pattern. It got me excited in the same way that noticing [AWS access key IDs were similarly-formatted][access-key-format] back in 2020. So of course I had to dig…
AWS principal tags are useful for fine-grained access control. As an organisation administrator, you can craft service control policies (SCPs) that only allow tagged roles to call sensitive APIs. The problem then becomes: how do you guarantee that the tags are legitimate? This is where resource control policies (RCPs) come in handy - I provide a demonstration of them in this blog post, and an…
Athena is one of my favourite AWS services. Though it's marketed as a big data service, it is useful in many other scenarios. Sometimes I use it as a 'grep through unstructured logs in S3' and other times I use it to query CloudTrail logs - but this latter use case is likely better served by CloudTrail Lake nowadays. Today, I'll show how it can be used for querying Terraform state stored in S3.
Lately, I've been interested in how third party vendors can best authenticate into their customers' cloud accounts. The status quo in AWS is usually role assumption from the vendor's account to the customers', but what about GCP and Azure? Can OIDC be used to authenticate into all three clouds in approximately the same way? I think the answer is yes, and this blog post aims to show how to do so.
Back in November last year, I [wished][prev-blog] for the ability to filter CloudTrail data events by the requesting principal's ARN. Two days later, my wish was almost granted: CloudTrail launched the ability to filter on userIdentity.arn for CloudTrail lakes but not trails . And now it seems my wish has almost completely come true: the functionality has rolled out to trails as well.
There are several ways that CloudFront can be configured with an S3 origin. There are functionality differences between them, but the focus in this blog post is how activity is represented in CloudTrail, specifically the differences in S3 data-level events for each CloudFront option.
UPDATE : My dream came true - almost. See follow-up [post][follow-up]. AWS re:Invent 2024 is fast approaching and there's usually a flurry of exciting new services and features for existing services launched around this time each year. I'll be there in person this year - come say hello if you are too!
Credentials for AWS IAM role sessions are short-lived. By default, they last for one hour. When calling AssumeRole you can request a different duration by passing a value between 900 (15 minutes) and 43200 (12 hours) in the DurationSeconds parameter. Note that this API call will fail if you request a session duration longer than is configured on the role itself (in the 'max sesson duration'…
tl;dr : Search CloudTrail for instances of AssumeRole with additionalEventData.explicitTrustGrant == false . These will yield results for role assumptions that aren't permitted by the trust policy, i.e. the ones that are going to surprise you - and violate your invariants like 'role session names will always be an employee's email address'.
AWS CloudShell got a [new capability][whats-new] in January 2024: running Docker containers. This piqued my curiosity because Docker-in-Docker usually implies privileged containers, and I have previously used that to [escape CodeBuild][codebuild] onto the parent EC2 instance. I wanted to know if the same could be done in CloudShell - and how its AWS credential system worked (the environment…
This article has been in my drafts for 380 days. It's probably time I published it, before I forget even more details about how it works. ~A few~ 380+ days ago, I published [ima.ge.cx][imagecx]. It's a web frontend for browsing the contents of Docker images. It's like a less powerful version of [ dive ][dive] that doesn't require you to pull images locally. It's also worth noting that there's a…
The short version: AWS IAM Identity Center exchanges third-party OIDC tokens for Identity Center-issued tokens. Identity Center relies on the jti claim in the third-party tokens to prevent replay attacks. Identity Center maintained a cache of previously-seen jti values for a fixed period (24 hours) and didn't enforce that the third-party tokens had expiry claims. This meant that a token with a jti…
A few years ago, I [wrote][akia-blog] about determining AWS account IDs from AWS access keys, i.e. those strings that begin with AKIA or ASIA . It's also possible to determine information from other AWS IAM unique IDs, specifically these two from the table in [Amazon's docs][docs].
Back in 2021, I [requested][my-blog] that AWS add some kind of 'claim-to-tag mapping' functionality to OIDC IDPs, so that we could have role session tags based on claims in OIDC tokens issued by GitHub Actions. That hasn't happened yet, but today I learned (thanks to [this comment][comment] and associated [blog post][orig-blog] by Daniel Jonsén) that the same outcome can be achieved by using AWS…