What Would You Cut If Your AWS CI Role Was Compromised?
Scanners show you the attack path. Almost nobody shows you which single deny stops a compromised CI role without taking down prod. That missing piece is containment.
HAIT | Cloud & DevOps Blog
Technical articles on AWS, Terraform, CI/CD, Kubernetes, and cloud architecture.
Latest posts
Building blast-audit: AWS attack path visualizer in the browser (no Neo4j, no Docker)
I built blast-audit, a browser-only AWS attack path visualizer. Drop a cloud-audit JSON, see the chain. 7 historical breach scenarios, BFS in 110 LOC.
AWS Abuse Pattern Detection: 10 Open Source Signals (2026)
cloud-audit Threat Feed v1 - 10 open source detectors mapped to documented 2025-2026 AWS incidents. Confirmed signals, strong heuristics, precursors. CLI, MIT.
Prisma AIRS on Azure: 8 SCM gotchas from a working lab
Field notes from building Prisma AIRS Network Intercept in Azure under Strata Cloud Manager. 8 silent failures (PBF without UDR, Target Models trap) - with fixes.
K3s on AWS in 2026: 4 IAM auth methods benchmarked
Side-by-side benchmark of 4 AWS auth methods for self-hosted K3s: Instance Profile, IRSA-S3, IRSA-CloudFront, Roles Anywhere. Cold start, failures, cost.
5 AWS IAM Privesc Scanners vs 57 Paths: Coverage from 7% to 93%
I ran 5 OSS AWS IAM privesc scanners against 57 escalation paths. Coverage ranged from 7% to 93%. Full matrix, raw outputs, and per-tool caveats inside.
AWS Bedrock AgentCore: VPC Mode Still Leaks DNS After Unit 42 Disclosure
I lab-tested all three AWS Bedrock AgentCore network modes after Unit 42's April 7 disclosure. SANDBOX now isolated, VPC mode still leaks DNS - fix inside.
12 Steps to Secure GitHub Actions After the Trivy Attack
What failed in the Trivy and tj-actions supply chain attacks. 12 concrete hardening steps with YAML and Terraform code for GitHub Actions pipelines.
5 Open-Source AWS Security CLI Tools Worth Trying in 2026
Prowler, Trivy, CloudFox, Heimdall, and cloud-audit compared. What each does, where it falls short, and which one fits your workflow.
Debugging AWS IAM and Privilege Escalation Using Multi-Model AI
How to debug IAM Access Denied errors, spot OIDC privilege escalation, and write Terraform fixes using multi-model AI consensus - querying multiple LLMs simultaneously to eliminate hallucinations.
CIS AWS v3.0 in 60 Seconds: Automate Compliance with Terraform
Run a full CIS AWS Foundations Benchmark v3.0 assessment from your terminal. 62 controls, 55 automated, per-control Terraform remediation.
Prowler vs ScoutSuite vs cloud-audit: 600 Checks vs 99
One scanner runs 600 AWS checks. Another is unmaintained since May 2024. The third fits your CI with 99 curated checks. Real runs, not marketing.
The GitHub Actions OIDC Mistake That Backdoors Your AWS
One missing condition in your IAM trust policy exposes every role to any public GitHub repository. I found this in a live audit. Here is the one-line fix.
AWS Cost Waste: 5 Things I Find in Every Audit
AWS cost waste averages 27-35% of cloud spend. 5 patterns I find in every audit: orphaned EBS, infinite CloudWatch retention, idle NAT Gateways, gp2 volumes, oversized RDS. CLI commands and Terraform fixes included.
Palo Alto on AWS: 9 GWLB Pitfalls I Hit in Production
Three years of Palo Alto VM-Series with GWLB and Transit Gateway. 9 failure modes that cost billable hours: asymmetric routing, MTU, health checks.
AWS Network Firewall: 0.59% Block Rate (CyberRatings)
Q1 2025 independent test: 12 of 2,028 exploits blocked by AWS Network Firewall. Zero against bypass techniques. Check Point and Palo Alto both above 99%.
AWS Access Denied: 7 Policy Layers and a 60-Second Fix
Since January 2026, AWS names the exact policy ARN that blocked you. 7-layer evaluation order, STS decode command, and a debugging flowchart.
AWS Network Firewall vs Palo Alto: 0.59% vs 99.6%
CyberRatings Q1 2025: AWS Network Firewall blocked 0.59% of 2,028 exploits. Palo Alto scored 99.6%. Full cost and detection comparison.
AWS Security Audit: 17 Issues in Every Account
Root without MFA, public RDS, 900-day-old keys. 17 AWS security misconfigurations I find in almost every account audit.
Vulnerability Reports for Executives
89 CRITICAL CVEs in production, CEO wants a report by Friday. A framework for translating scan results into executive action.
Terraform Variable Validation: 3 Copy-Paste Patterns
Validation blocks, preconditions, and postconditions. Three snippets you can drop into any Terraform module today. When each beats the others.
Cloud Run SIGILL: Sapphire Rapids Broke llama.cpp AVX-512
Google silently swapped to Sapphire Rapids without AVX-512 runtime. llama.cpp crashed after 6 months working. The 20-second fix and how to detect it first.