TrailTool 1.0: Identity-First Sessions for CloudTrail
TrailTool 1.0 replaces time-based session grouping with an identity-first model, treats CloudTrail as a replayable transaction log, and cleans up the CLI.
EngSecLabs
Alex Smolen's notes on security engineering, leadership, and practice — plus the open-source security tools he builds.
Latest posts
Credential isolation and least privilege for AWS agents
A proxy that holds real AWS credentials, gives agents fake keys, re-signs outbound requests, and generates a least-privilege policy from observed behavior.
AWS Credential Isolation for Local AI Agents
How to give a local coding agent exactly the AWS access it needs, nothing more, using elhaz
TrailTool: CloudTrail for AI Agents
TrailTool pre-aggregates CloudTrail events into entities, making AI-driven security analysis fast, cheap, and actionable.
GraphGRC v2: SOC 2 Compliance in GitHub
Commercial GRC tools can cost $12K+/year and lock your compliance docs in proprietary systems. GraphGRC v2 gives you SOC 2 documentation in GitHub - pre-written controls, policies, and processes in Markdown with automated validation. Free and open source.
Fix Dependabot Security Alerts That Don’t Open Pull Requests
Dependabot throws security alerts but sometimes can't create pull requests. Here's a GitHub Action that automatically sends failed alerts to Copilot for resolution.
Backyard APT: A Raccoon Story
Raccoons are both advanced and persistent threats. After one attacked my chihuahua Jolene, I declared war on my backyard invaders. Through ultrasonic deterrents, motion-activated sprinklers, and wacky inflatable air dancers, I learned critical security lessons - including that removing attacker incentives beats detection every time.
Data Retention is Two Different Problems
Data retention covers two different problems - preservation (minimum time you must keep archival data) and deletion (maximum time you can keep personal data). They require opposite technical approaches - one prevents deletion, the other enforces it. The elegant solutions? Indefinite and ephemeral data.
Role-Based Everything: Aligning Access Control, Policies, and Training
Your new hire sits through generic security training, clicks through a 47-page policy, and gets random access over time. Three months later they ping for production access. The policies? Nobody's looked at them since day one. There's a better way.
Refocusing Vendor Security on Risk Reduction
Modern software companies use a lot of software services. Traditional security teams address third-party risk through certifications and questionnaires, but there's an opportunity to actually reduce risk by collaborating with implementation teams on secure configuration decisions.