AWS security, code, and compliance
Delegating access increases your security posture by limiting reasons to log in to your AWS organizations management account, until it doesn't. I've seen multiple customers go through the work of setting this up, only to find out they still need to log in to the management account
AWS access management isn't the most exciting topic, but it is absolutely critical to AWS security, so keep it simple.
Most developers I speak to don't equate spend to security, but an unusual budget event is a big red flag for your AWS environment.
AWS in 2025 is complex. With over 16,000 API methods, 400 service namespaces, and more than 18,000 permissions, mastering AWS is challenging enough. Securing it properly while maintaining this complexity? That seems nearly impossible. Yet security doesn't have to be complicated. By focusing on these five
This post original appeared on the CommonFate.io blog . Still using IAM Users for AWS access? You're not alone. According to Datadog's 2024 State of Cloud Security report, 46% of organizations still rely on IAM Users for AWS access. However, with AWS Identity Center (formerly AWS
This post original appeared on the CommonFate.io blog . If you’re the administrator or owner of an AWS environment and are still relying on IAM users for your human users to access AWS IAM, then you should be considering migrating to AWS IAM Identity Center. As a security
It's happened. It's finally here. No, I'm not talking about the next iPhone. I'm talking about programmatic access to the AWS IAM action list! Wait, what do you mean "I'm not excited about that"?! Get your priorities straight.
List all AWS Lambda functions running deprecated runtimes in your environment as a spreadsheet.
Last week I passed the latest version of the AWS Security Speciality (SCS-C02). The Security Speciality certification assesses your knowledge of the various AWS security services, and the security capabilities of more general services offered by AWS. Big shoutout to the AWS Community Builders ! One of the perks of
Set up OAC between CloudFront and your bucket with aws:SourceArn.
Granting 3rd parties access to your AWS resources via roles should always use external ID condition. If a vendor asks you to provision an IAM user with access + secret key in 2023, they're doing it wrong. External IDs are used as part of the condition block on a
The AWSLambdaBasicExecutionRole is an AWS managed policy , and one of the most common managed policies you should consider using, at least for quick development; it's the minimum amount of permissions to see what your AWS Lambda functions are doing, and without you won't get any logging
This interesting policy question on re:Post about how you can prevent principals outside of an AWS organization from assuming a role in your organization. The asker originally requests an SCP to do this, but SCPs cannot apply to principals outside the organization so cannot fulfil this scenario. The top
A feature I think everyone (including myself!) should use more is AWS Serverless Application Model (SAM) policy templates . This approach is a great example of " syntactic sugar " that characterises the AWS SAM approach. As an example, a frequent requirement for your serverless application functions is to create, read,
Why doesn't this policy work with this condition?