Recent content on zoph.me, AWS Cloud Security and Indie Consulting
ClickOps Sentinel detects AWS Console (ClickOps) changes in near real time and investigates each one with a Claude agent on Amazon Bedrock, then alerts Slack, Teams, or a rich HTML email. Open source, EventBridge-native, no CloudTrail trail to parse.
How I run my Home Assistant config like production: an AI coding agent edits the live YAML, I review the diff, and everything is versioned in Git.
Welcome to my side projects page, where I’ve open-sourced a collection of tools and projects that I’ve built over the years. With a focus on the AWS ecosystem, these projects have been a way for me to learn and explore new technologies. While they were created with my specific use-cases in mind, I hope they can be helpful to others as well. Most of them came out of my independent AWS…
Replacing 1,500 AWS CLI invocations with one boto3 session and a ThreadPoolExecutor cuts IAMTrail's Fargate scan from 46 minutes to 2 min 30s. Byte-level format gotchas, real numbers, peak cloud economics.
My name is Victor GRENU , Independent AWS Cloud Consultant. Over 20 years in IT. Life is a series of quests. Some you choose, some choose you. Side Quests The IT Journey. Started in IT in 2005, working through various large enterprises across different industries. In 2020, I launched my own consulting boutique: zoph.io . Independent AWS consulting, building secure, scalable, cost-effective…
IAMTrail tracks every silent change to AWS Managed IAM Policies since 2019. Full diffs for 1,545+ policies, endpoint signals across 46 regions, email digests. Evolved from MAMIP.
Attackers abuse CloudFormation Launch Stack URLs to phish AWS account takeover via admin IAM roles. Anatomy of the attack, detection signals, and blue team controls.
Curated AWS and cloud security reading from summer 2024: IAM tooling, S3 block storage history, Route 53 best practices, over-engineering, and Wiz security migrations.
After 5 years running an indie AWS consulting boutique: market saturation, falling daily rates, why you should specialize in a niche, and how to diversify revenue.
AWS PrivateLink hides the source client IP from your backend. Here is how to enable Proxy Protocol v2 on Squid behind an NLB to preserve real client IPs in access logs.
Most AWS workloads do not need event-driven Kubernetes. Start simple, work backwards from RTO/RPO, ignore reversibility. You are not Netflix. Keep architecture dead simple.
AWS Security Digest, the weekly AWS security newsletter I launched in 2021, was acquired by Plerion in May 2024. The story behind the project and its acquisition.
Top 5 most-clicked AWS Security Digest links of 2023: JIT S3 access, security best practices cheat sheet, AWS Security Foundations, baseline alerting, and ImdsPacketAnalyzer.
AWS Security Survival Kit: open source CloudFormation alerts for the bare-minimum suspicious activity you should catch in any AWS account. Free, opinionated, drop-in.
Are you tired of manually checking your AWS subnets to make sure they’re not approaching the free remaining IP limit? Look no further than Subnet-Watcher, an open-source tool I’ve developed at zoph.io . Subnet-Watcher allows you to automatically check your subnets for a variety of metrics, such as whether they have the correct number of available IP addresses, or the number of detached…
TL;DR Key takeaways: Building trust and relationships with a community of experts is crucial for success. Continuously staying up-to-date with the latest trends and best practices in your field and maintaining a curious mindset is important for delivering innovative solutions. Diversifying your business streams, such as through a SaaS product or newsletter, can help to increase success and growth.…
💸 Rational Using the public cloud will let you do experiments, iterate, test new services and new capabilities; it will unleash the potential of your teams to do innovation and, in the end, reduce the time to market with innovative products. Cloud computing comes with a promise: “Pay as you go” . In fact, this statement is partially true. However, it is only accurate if you take care…
Update from: 2021-12-23 Official Security bulletin from AWS AWSSupportServiceRolePolicy Informational Update https://aws.amazon.com/security/security-bulletins/AWS-2021-007/ You will find below details about the security incident that led to this unattended access for millions of AWS customers. On 22nd December 2021 , AWS deployed a new version ( v20 ) of AWSSupportServiceRolePolicy , used by a…
Rationale Lately, I was looking for a small automation to deploy a simple web redirect for a domain name hosted on Amazon Route 53. I didn’t find anything relevant, so I’ve decided to do it by myself. The goal was to have a subdomain redirect to a totally different domain and path using minimal effort and infrastructure. From: asd.zoph.io To: http://awssecuritydigest.com Schema…
Disclaimer: I’m not a REGEX expert :smile: Lately, I was working for one of my customers on a custom configuration of AWS Config recorder. My customer wanted to record all resources using AWS Config, except for a few of them: 'AWS::EC2::Subnet' 'AWS::EC2::VPC' 'AWS::EC2::SecurityGroup' Unfortunately, the AWS API and Console do not allow you to do this; you have to manually cherry-pick which…
TL;DR: AWS Managed Policies are safe. Currently. :arrows_counterclockwise: Previously in Policy Validation Before the AWS Access Analyzer (AA) Policy Validation release, a few open source initiatives were available to lint AWS IAM Policies, like Parliament from Duolabs and CloudSplaining (Salesforce). The tricky part of these tools is that they are community-driven, from volunteer contributors,…
Since my last post on how to deal with information overload and reading pipeline, I’ve created a free digest newsletter about AWS Security . The goal of this curated AWS Security Digest is to condense what happened last week, from the most relevant sources: 🔦 A highlight of the week 👮 Changes since last week on AWS Managed IAM Policies 💌 Curated cloud security newsletters 👀 AWS API…
Disclaimer This post contains affiliate links. Introduction As you know, in Information Technology, things are evolving fast. Too fast to stay up to date without losing your mind to information overload/fatigue. To remediate that, I will give you my daily/weekly routine and tips to stay focused on your tasks/objectives without missing anything interesting, and to assimilate it at your own pace.…
TL;DR HighCharts -> APIGW -> DynamoDB + Lambda function 🎉 cockpit.zoph.io Introduction Lately, I was working on a new version, API based , for my Twitter Cockpit. In the previous version, Highcharts was loading data from some flat csv files. The goal of this cockpit is to retrieve and store unlimited history for specific Twitter accounts based on a Twitter list. It means that you can control from…
TL;DR I’m working remotely for 145+ days. (March 2020) Setup In this post, I will describe my setup for Work From Home (WFH) @ zoph.io . I’m now using this setup daily since March 2020 due to the pandemic crisis. Compute I’ve been using macOS for 24 years now 👴. My first ever computer was a Performa 5200 (with TV Tuner card inside folks!! 📺). Nowadays, I’m using a MacBook…
TL;DR I’m now using PGP for archive file encryption. The trigger This summer, I read Permanent Record from Edward Snowden , “Ed” for those in the know. I was pretty impressed at how a government organization with a multi-billion dollar budget can organize a mass surveillance program at a worldwide scale in only a few decades. “Encryption works. Properly implemented strong crypto…
This post was updated in July 2020. It was originally my first post on this blog in December 2016. 👴 I’m often asked by many colleagues, friends, or Twitter followers where to start with Amazon Web Services (AWS). In this post, I will try to explain where you should start in 2020. I’ll try to write this post as I wish I had when I got into this technology in 2016.
This post was co-authored by Teddy Ferdinand . Who is working as Cloud Security Architect 🐻 Introduction In this series, we will talk about the emergence of the DevSecOps movement, and more especially, what the benefits are of introducing a DevSecOps approach to your existing CI/CD Pipelines. CI/CD Pipeline To give you some context, you will find in the diagram below a standard DevOps CI/CD…
This post is the second part of a series about my journey as an Independent AWS Cloud Architect. Status As I already told you in the first part , I started my own business in early January 2020. After the first 6 months of being an Independent AWS Architect in France, I’m very happy with this move, no regret, and I don’t see any upcoming U-turn to come back as a full-time employee.
TL;DR: I search “@awscloud” in their Twitter Bio and add their profiles to a public Twitter list. One opportunity to get fresh news from the AWS ecosystem is to follow relevant current or former Amazon (Web Services) employees called Amazonians on Twitter, but it can be difficult to stalk their profiles across the myriad of user profiles talking about #AWS subjects… Lately, I…
Hi Folks, Lately, I was experimenting with GitHub Actions (GHA), as it has been a buzzword since General Availability (GA), but I didn’t take the time to try it before. I’ve done it for you folks. 🙌 Context GHA was released on GA in November 2019, the main features are: Automate development workflows (CI/CD): build , test , deploy Hosted runners / self-hosted runners Automate the…
Hey folks, Recently, I was trying to level up the observability of my home automation system, and I was inspired by what has been done by Carmelo and Patrick , who had similar experiences for their own needs. TL;DR 1 2 3 git clone https://gitlab.com/z0ph/tower-control.git docker-compose up -d open http://localhost:3000 # admin/admin Going Further :mag_right: Previously, the only graph that I had…
This article was originally posted in September 2019. Updated in February 2020. Disclaimer Thanks to @0xdabbad00 from SummitRoute for the original idea and jq parsing. Purpose When your production workloads rely on AWS IAM Managed Policies (don’t do this), you will need to be notified when changes occur behind the scenes. It’s also interesting to monitor new AWS service releases ahead…
Quick post today about cost saving on AWS. As you know, two of my preferred subjects on Public Cloud are Security and FinOps! Recently, AWS introduced a way to reduce AWS bills by up to 70% using Spot instances with the AWS Fargate service. It’s really easy to use. If your workload is interruption-proof, batch jobs, or CI/CD containers, don’t hesitate to use it to drastically reduce…
qTweet is a dead simple AWS SQS to Twitter serverless speaker :speaker:. Publish message :love_letter: to SQS (FIFO), Lambda function will handle publishing it to Twitter. Automagically. :tada: To be honest, my plan is to automate the tweet of certain information using this queue in multiple side projects. As usual, I’m sharing this with you folks as I was not able to find an equivalent in…
Canary What? In software testing, a canary (also called a canary test) is a push of programming code changes to a small number of end-users who have not volunteered to test anything. The goal of a canary test is to make sure code changes are transparent and work in a real-world environment. Canary tests, which are often automated, are run after testing in a sandbox environment has been completed.…
In December 2019, I’ve decided to switch from a long-time (15 years) habit of Full-Time Employee (FTE) contracts to running my own business as an Independent AWS Cloud Architect . This decision came to me after a few disappointments from my past experiences as a traditional employee/consultant, and I had been thinking about this switch for several years. It was the perfect time for me to…
In my day-to-day job, I was wasting time reinstalling and dealing with the dependencies of all my favorite tools for AWS Security Audits and Assessments. So, lately, I’ve decided to start another pet project trying to solve this issue and provide a simple Docker container with all the security-related tooling for your AWS Assessments. I’ve decided to open-source it. After some…
I was wondering if I could schedule simple bash scripts using AWS Fargate for some trivial batch operations. To be completely honest, it is also an excuse to learn more about AWS Fargate, and to convert a legacy bash script based on EC2 Spot instances to a container world. In this post, we will see how to schedule a bash script job once a day. To do so, we will deploy the corresponding AWS…
Disclaimer: This article was written with my co-author: Sandro aka Khrarec. thx dude. Introduction With the rise of cloud managed services comes a very important one: the databases. So, what’s a managed database service? Basically, a database is a server-side software like MySQL, MariaDB, PostgreSQL, or for NoSQL, Redis, MongoDB, etc. But when you install and build your database server that…
re:Inforce 2019 Il s’agit de la première édition de cette conférence AWS dédiée à la sécurité de ce Cloud Service Provider (CSP). AWS est actuellement en train de proposer de nouveaux événements et summits sur des sujets spécifiques, en plus de l’événement annuel, le re:Invent. Cette conférence aura lieu chaque année dans une ville différente des États-Unis, il est question de Houston…
Présentation Anciennement “la Nuit du Hack”, c’est une conférence sur la sécurité informatique, le ethical hacking de manière plus générale, organisée depuis plus de 16 ans par la même équipe . Cette année était la première année après son changement de nom, les organisateurs attendaient cette fois-ci plus de 3500 personnes. J’ai eu la chance d’y participer pour la…
Info: This is our first post in a series of co-authored articles with @kharec . Serverless SFTP with AWS Transfer for SFTP Sometimes in the web world, we need to quickly deploy a space to share data with programs or with other humans. One of the numerous solutions is an SFTP space out there. But you know: create the server, configure the service, partition the users, the permissions, the folders,…
Following the announced new opt-in option regarding the default encryption of EBS volumes a few days ago, I’ve made a small Python script to enable this feature on all AWS regions within an AWS account. Quick and Dirty Simple. This is an example. Use it at your own risk, and test it before applying to production, as usual :) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 import…
In this article, I will describe my current pet projects. These are mainly excuses to learn something new, or exercises to go deeper into particular technologies, but could be (I hope) useful for you too. Don’t hesitate to issue enhancements, bug fixes (PR), or just give it a try and share your thoughts. Instance Watcher :construction_worker: Tech: Lambda, Python, Serverless Application…
In this post, you will find my best tools to work with if you are playing around with AWS services. Please let us know yours in the comments below :punch: Last Update: 2019-02-14 General :construction: Description Links Use multiple AWS Accounts on the same browser using Firefox Containers Firefox Containers Facilitate your switch role experience with this AddOn FF - Extend Switch Roles - Chrome -…
Previously I wrote an article on my blog’s pipeline. It was quite complex for this dead simple use case: Publish a static website from markdown files Automate build to convert markdown into html static pages using Jekyll Be able to preview articles with a draft subdomain A few months ago, during re:Invent'18, AWS launched a new service called AWS Amplify Console. I didn’t pay attention…
Retour sur une semaine incroyable et riche en annonces comme à l’accoutumée pour cette nouvelle édition du salon annuel Amazon Web Services (AWS) à Las Vegas. Dans cet article, nous allons revenir sur les principaux lancements de cette année, des plus importants aux plus inattendus. Quelques chiffres avant de commencer, AWS est un business avec un CA de 27Mds$, avec une croissance de 46-49%.…
Pre-re:Invent'18 Launches 🚀 (November 2018) AWS Region in Milan, Italy . CloudFormation Drift Detection . EC2 Auto Scaling Groups With Multiple Instance Types & Purchase Options . Train Custom Document Classifiers with Amazon Comprehend . Amazon S3 Block Public Access – Another Layer of Protection for Your Accounts and Buckets . Using AWS CodePipeline to Perform Multi-Region Deployments . AWS…
In this quick article, I’ll show you how I use AWS SSM Parameter Store as glue between Terraform and Ansible. Use Case For a personal project, I needed to pass some parameters (key/value) and secrets (encrypted) from my IaC Terraform to Ansible. AWS SSM PS? AWS SSM Parameter Store is a secure key-value store, a native EC2 functionality. From AWS Documentation : Parameter Store offers the…