🔶 All Paths Lead to Your Cloud: A Mapping of Initial Access Vectors to Your AWS Environment

Post which analyzes AWS initial access vectors through identity-driven misconfigurations, categorizing them into service exposure (Lambda, EC2, ECR, DataSync) and access by design (IAM/STS, IoT, Cognito) vulnerabilities that compromise cloud perimeter security.

https://www.paloaltonetworks.com/blog/cloud-security/aws-initial-access-cloud-perimeter-security/

(Use VPN to open from Russia)

#aws

🔶 AWS Lambda Managed Instances: A Security Overview

An initial security overview of AWS Lambda Managed Instances, exploring the Bottlerocket-based architecture, the 'Elevator' components, and security insights for this new compute model.

https://www.offensai.com/blog/aws-lambda-managed-instances-security-overview

(Use VPN to open from Russia)

#aws

🔶 AWS Builder Center

A portal collecting hands-on workshops crafted by AWS experts to gain practical experience and solve real business challenges.

https://builder.aws.com/build/workshops

(Use VPN to open from Russia)

#aws

🔶 yams

A Go library, server, and CLI providing foundational capabilities to simulate access for AWS IAM policies.

https://github.com/nsiow/yams

#aws

🔶 IAMhounddog

A tool to help pentesters quickly identify privileged principals and second-order privilege escalation opportunities in unfamiliar AWS accounts.

https://github.com/VirtueSecurity/IAMhounddog

#aws

🔶🔷🔴 tokenex

A Go library that securely exchanges identity tokens for temporary cloud credentials, with built-in support for AWS, GCP, Azure, OCI, Kubernetes, and OAuth2. You can also refer to the companion blog post.

https://github.com/riptideslabs/tokenex

#aws #azure #gcp

🔶 aws-extend-switch-roles

Extend your AWS IAM switching roles by Chrome extension, Firefox add-on, or Edge add-on.

https://github.com/tilfinltd/aws-extend-switch-roles

#aws

🔶 boto3-refresh-session

A simple Python package for refreshing AWS temporary credentials in boto3 automatically

https://github.com/michaelthomasletts/boto3-refresh-session

#aws

🔶🔷🔴 Dear, cloud family!

Wishing you a New Year filled with innovative solutions, seamless deployments, and sky‑high success! May your cloud infrastructure be always resilient and your downtime — zero. Happy New Year 2026!

We'll be taking a short break and returning in a few days to bring you new, professional content.

#HappyNewYear

🔶 What is EC2 Instance Attestation

EC2 Instance Attestation extends attestable scope from Nitro Enclaves' container environment to entire EC2 instances, enabling greater capabilities like GPU access. However, it requires proactive hardening versus Enclaves' secure-by-default design and more complex deployment through Attestable AMIs.

https://blog.richardfan.xyz/2025/12/18/what-is-ec2-instance-attestation.html

#aws

🔶 BadPods Series: Everything Allowed on AWS EKS

How to exploit misconfigured Kubernetes pods on AWS EKS using BishopFox's BadPods "everything-allowed" manifest. Shows container escape via chroot, lateral movement using nsenter, and cloud credential theft via IMDS.

https://cybersecnerds.com/badpods-series-everything-allowed-on-aws-eks/

#aws

🔶 pathfinding cloud

An AWS IAM Privilege Escalation Path Library. You can also refer to the companion blog post.

https://github.com/DataDog/pathfinding.cloud

#aws

🔶 Unauthenticated Cluster Takeover in AWS ROSA

A critical vulnerability in AWS ROSA Classic allowed unauthenticated attackers to discover clusters via Certificate Transparency logs, extract cluster UUIDs and owner emails from unauthenticated endpoints, initiate unauthorized cluster transfers, and escalate to AWS account access through ROSA's IAM roles.

https://blog.ryanjarv.sh/2026/01/05/unauth-aws-rosa-cluster-takeover.html

(Use VPN to open from Russia)

#aws

⚙ A Brief Deep-Dive into Attacking and Defending Kubernetes

This article covers Kubernetes attack and defense techniques. Explores Kubernetes components (API Server, ETCD, kubelet), attack vectors including unauthenticated API access, RBAC misconfigurations, ServiceAccount token abuse, malicious admission controllers, CoreDNS poisoning, writable volume mounts, ETCD compromise, and certificate authority exploitation.

https://heilancoos.github.io/research/2025/12/16/kubernetes.html

#kubernetes

⚙ Kubernetes v1.35: Restricting executables invoked by kubeconfigs via exec plugin allowList added to kuberc

Kubernetes v1.35 introduces beta support for restricting credential plugin executables via kuberc configuration. Users can set "credentialPluginPolicy" to AllowAll, DenyAll, or Allowlist, with an optional "credentialPluginAllowlist" to specify permitted binaries, enhancing security against supply-chain attacks.

https://kubernetes.io/blog/2026/01/09/kubernetes-v1-35-kuberc-credential-plugin-allowlist/

#kubernetes