aws

Cloudtrail events in AWS offer a lot of visibility into the calls that roles leverage within the platform. Sometimes tracking the original source of the activity can be challenging. When users and other aws services from one account assume role into another hunting the origin can take a bit of backtracking.

Overview of an anomaly detection platform using cloudtrail logs, athena, lambda, s3, and dynamodb

Walkthrough of Elastic Map Reduce compromise, and why it should never be directly exposed to the Internet.

IAM roles can have all current credentials revoked. This can be great to stop an attacker, but at what cost?