OCI Unused IAM Permissions: Detecting via Audit Logs
OCI has no IAM Access Analyzer. Detect unused IAM permissions by cross-referencing Audit Service logs against policy statements with the OCI SDK.
$blogTopics | % {echo $_}
Technical blog about development, ai, security, and cloud engineering by Victor Silva.
Latest posts
Azure Firewall vs NSGs: A Defense-in-Depth Security Model
NSGs and Azure Firewall stop different attacks. Here's the default-rule bypass that lets lateral movement and exfiltration slip past a hub firewall.
AWS Secrets Manager Terraform: Least-Privilege Access
Can't edit the IAM role? Lock down AWS Secrets Manager with Terraform's aws_secretsmanager_secret_policy for genuine least-privilege access control.
GCP Cloud Run Security Terraform: IAM, Egress, BinAuthz
Cloud Run no tiene cluster_admission_rules. IAM invoker bindings, Direct VPC egress y Binary Authorization por servicio, con Terraform, sin repetir GKE.
Azure Managed Identity: System-Assigned vs User-Assigned
The wrong managed identity choice breaks Key Vault access on every Azure redeploy. Terraform for five real system-assigned vs user-assigned scenarios.
Signing OCIR Images with Cosign and Kyverno verifyImages
Sign OCIR images by digest with Cosign and enforce at admission using Kyverno verifyImages on OKE, with OCI Vault Secrets managing the key passphrase.
OCI Cloud Guard Terraform: Threat Intelligence and Auto-Remediation
Enable OCI Cloud Guard with Terraform: clone detector and responder recipes, wire automated remediation via OCI Events and Functions, and query Threat Intelligence IOCs from the CLI.
OCI Bastion Service with Terraform: SSH and Port Forwarding
OCI Bastion Service with Terraform: Bastion plugin setup, managed SSH and port forwarding sessions, and security list rules scoped to the bastion's /32 IP.
Kyverno on OKE: Admission Policies Without Rego
Kyverno on OKE: enforce admission control, auto-generate NetworkPolicies, and mutate resources in plain YAML. A no-Rego alternative to OPA Gatekeeper.
OCI Vulnerability Scanning Service with Terraform
Configure OCI Vulnerability Scanning Service with Terraform to scan Compute instances and OCIR container images for CVEs, open ports, and CIS benchmarks.