Get a demo

Cloud Security Blog

"But without PassRole it should be fine", Lambda edition

Your IAM review blessed it. No PassRole, must be safe. Here's how lambda:UpdateFunctionConfiguration runs code under a privileged role anyway.

Daniel Grzelak

Pwn request: scanning GitHub for the vulnerability that took down Trivy

We scanned 5,400+ repos. 48 had the same flaw. Here's what we found.

Brad Talbot

Your vulnerability backlog is mostly fiction

Most vulnerability backlogs are mostly fiction. Plerion shows which CVEs can actually be exploited in your environment, so your team fixes what matters.

Mike Rahmati

Don’t expose yourself in public - let AWS error messages do it for you

AWS now reveals public permissions in error messages. Learn how a deny-all session policy exposes which actions would succeed safely.

Daniel Grzelak

Testing Access to AWS Resources Without Angering the People That Pay the Bills

We built a system to safely prove AWS resources are exposed, without reading data, changing state, or breaking anything. Here's the methodology.

Daniel Grzelak

Privilege escalation with SageMaker and there's more hiding in execution roles

A subtle AWS privesc hiding in SageMaker lifecycle configs, and what it reveals about execution roles.

Daniel Grzelak

Things you wish you didn't need to know about AWS service-linked roles

The AWS roles you never create, can’t control, and might reveal your service usage. This is why service-linked roles are way stranger than you expect.

Daniel Grzelak

Bedrock'n'role: Annoying trust relationships in Bedrock service roles

A subtle security gap in Amazon Bedrock’s console-created execution roles allows any agent in the account to assume roles by default.

Daniel Grzelak

Found it. Fixed it. Done.

Start free. Understand your cloud in under an hour.

Get startedBook a demo