CloudSec Wine

🔶 AWS IAM Identity Center now supports customer-managed KMS keys for encryption at rest

Gain control over encryption and comply with regulations using customer-managed keys for AWS IAM Identity Center's user data and passwords.

https://aws.amazon.com/ru/blogs/aws/aws-iam-identity-center-now-supports-customer-managed-kms-keys-for-encryption-at-rest/

(Use VPN to open from Russia)

#aws

🔴 Announcing quantum-safe Key Encapsulation Mechanisms in Cloud KMS

GCP now supports post-quantum Key Encapsulation Mechanisms in Cloud KMS, in preview, enabling customers to begin migrating to a post-quantum world.

https://cloud.google.com/blog/products/identity-security/announcing-quantum-safe-key-encapsulation-mechanisms-in-cloud-kms/

#gcp

🔶 Do you feel in control? Analysis of AWS CloudControl API as an attack tool

Abusing AWS CloudControl API to stealthily enumerate resources, persist in accounts, and evade detection.

https://www.exaforce.com/blogs/feel-in-control-analysis-of-aws-cloudcontrol-api

#aws

🔶 Crimson Collective: A New Threat Group Observed Operating in the Cloud

Rapid7 has observed increased activity of a new threat group attacking AWS cloudenvironments, Crimson Collective, who recently claimed to have stolen private repositories from Red Hat's GitLab.

https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/

#aws

🔷🔴 OmniProx

IP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlare.

https://github.com/ZephrFish/OmniProx

#azure #gcp

🔶🔷🔴 tokenex

A Go library that securely exchanges identity tokens for temporary cloud credentials, with built-in support for AWS, GCP, Azure, OCI, Kubernetes, and OAuth2. You can also refer to the companion blog post.

https://github.com/riptideslabs/tokenex

#aws #azure #gcp

🔶 Billing View now supports cost management data from multiple organizations

AWS announced the general availability of new capabilities within AWS Billing and Cost Management that enable customers to manage their AWS spend across multiple organizations through a single AWS account.

https://aws.amazon.com/ru/about-aws/whats-new/2025/09/billing-view-cost-management-multiple-organizations/

(Use VPN to open from Russia)

#aws

🔶 How to develop an AWS Security Hub POC

This article guides you through planning and implementing an AWS Security Hub proof of concept, covering value assessment, success criteria definition, configuration, deployment, and validation steps.

https://aws.amazon.com/ru/blogs/security/how-to-develop-an-aws-security-hub-poc/

(Use VPN to open from Russia)

#aws

🔶 Build secure network architectures for generative AI applications using AWS services

Post which reviews the secure network design principles that provide a robust foundation for deploying generative AI applications on AWS while maintaining strong security controls.

https://aws.amazon.com/ru/blogs/security/build-secure-network-architectures-for-generative-ai-applications-using-aws-services/

(Use VPN to open from Russia)

#aws

🔶 How to accelerate security finding reviews using automated business context validation in AWS Security Hub

A structured workflow where security teams define acceptable compensating controls, developers implement them, and an automated system validates their effectiveness.

https://aws.amazon.com/ru/blogs/security/how-to-accelerate-security-finding-reviews-using-automated-business-context-validation-in-aws-security-hub/

(Use VPN to open from Russia)

#aws

🔴 Strengthen GCE and GKE security with new dashboards powered by Security Command Center

The GCE Security Risk Overview page now shows top security findings, vulnerability findings over time, and common vulnerabilities and exploits (CVEs) on your virtual machines.

https://cloud.google.com/blog/products/identity-security/new-gce-and-gke-dashboards-strengthen-security-posture/

#gcp

🔶 IMDS Abused: Hunting Rare Behaviors to Uncover Exploits

This post is about how Wiz used a data-driven methodology to uncover and stop anomalous IMDS usage, and how that approach led them to discover a zero-day vulnerability being exploited in the wild in a popular web service.

https://www.wiz.io/blog/imds-anomaly-hunting-zero-day

#aws

🔶 Introducing the AWS Infrastructure Canarytoken

This post introduces AWS Infrastructure Canarytoken, a new free tool that helps deploy decoy AWS resources (DynamoDB, S3, SSM Parameters, etc.) to detect attackers exploring compromised AWS accounts.

https://blog.thinkst.com/2025/09/introducing-the-aws-infrastructure-canarytoken.html

#aws

🔶 Adding Determinism and Safety to Uber IAM Policy Changes

Uber's production environment relies on a complex network of microservices and assets governed by IAM policies. Managing these policies effectively without disrupting production is challenging, as highlighted by an incident where an accidental IAM policy change caused Uber Eats outages. To address this, Uber introduced a Policy Simulator tool that allows policy authors to preview the impact of proposed changes in real time.

https://www.uber.com/en-GB/blog/adding-determinism-and-safety-to-uber-iam-policy-changes/

#aws

🔶 Automate OIDC client secret rotation with Application Load Balancer

Elastic Load Balancing simplifies authentication by offloading it to OpenID Connect (OIDC) compatible identity providers (IdPs). This lets builders focus on application logic while using robust identity management.

https://aws.amazon.com/ru/blogs/security/automate-oidc-client-secret-rotation-with-application-load-balancer/

(Use VPN to open from Russia)

#aws

🔶 Multi-Region keys: A new approach to key replication in AWS Payment Cryptography

The new Multi-Region key replication feature in Payment Cryptography enhances automatic key replication capabilities, providing improved resilience and simplified management for global payment applications.

https://aws.amazon.com/ru/blogs/security/multi-region-keys-a-new-approach-to-key-replication-in-aws-payment-cryptography/

(Use VPN to open from Russia)

#aws

🔶🔷🔴 Comparing CSP-Managed Machine Identities

This paper compares the threat models of machine identities managed by the CloudService Providers (CSP-managed) across the three major cloud service providers, with a focus on the risks associated with impersonation and usage.

https://cdn.prod.website-files.com/64e50cbe2b6f932c04238c14/68c18f3c1a686fcdf26e81ac_V_WP_Comparing-CSP-Managed-Machine-Identities_090925_FNL%20(1).pdf

#aws #azure #gcp

👩‍💻 Illicit Consent-Granting & App Backdooring – Obtaining persistence in Entra

This article details how attackers exploit Entra ID through OAuth consent injection and app backdooring, covering attack flows, MITRE ATT&CK mappings, detection strategies, and prevention methods for securing consent flows.

https://www.slashid.dev/blog/entra-app-backdooring/

#azure

👩‍💻 One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens

This article details a critical vulnerability discovered in Entra ID that allowed full tenant compromise through undocumented Actor tokens and a flaw in Azure AD Graph API's tenant validation. Microsoft patched it under CVE-2025-55241.

https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/

#azure

👩‍💻 Azure mandatory multifactor authentication: Phase 2 starting in October 2025

Multifactor enforcement for Azure Portal sign-ins was rolled out for 100% of Azure tenants in March 2025. Now, Azure is announcing the start of Phase 2 MFA enforcement at the Azure Resource Manager layer, starting October 1, 2025.

https://azure.microsoft.com/en-us/blog/azure-mandatory-multifactor-authentication-phase-2-starting-in-october-2025/

#azure