Andoni A.

Do you want to build "the perfect pipeline"?

@Paco_S and I will present "Level Up Your CI/CD: Building a secure pipeline with OSS" workshop at @cloudvillage-dc.bsky.social @defcon.bsky.social 🚀

We're at @fwdcloudsec.org and we have stickers. I do not know what else to say so just find us (or the stickers we left around 😂)

FinOps for Engineers: How to create real impact in your organization, Thu, Jun 12, 2025, 6:30 PM | Meetup **Talk: "FinOps for Engineers: How to create real impact in your organization"** Learn about FinOps culture from the engineering point of view and how to create a positive

Is your boss telling you to reduce the bill? Then this meetup is perfect for you!

FinOps for Engineers: How to create real impact in your organization 💸
with Ernesto Suarez, CEO at @GlassityStartup

🗓Thu, June 12
⏰⁣18:30h
📍@FlywireEng
office
📝RSVP: www.meetup.com/aws-valencia...

Introducing a New Way to Track AWS Documentation Changes | Miggo Introducing The New Way to Track AWS Documentation Changes

www.miggo.io/resources/in...

An AWS Documentation Change Tracker, cool 👏🏻

awssecuritychanges.com

YouTube video by Kevin Fang Capital One's $200M Cloud Data Breach

Would you prefer a video? I also have a video. www.youtube.com/watch?v=r7HV...

Steal EC2 Metadata Credentials via SSRF - Hacking The Cloud Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.

Never heard about this? No problem.

Take a look to hackingthe.cloud/aws/exploita... to quickly understand how attackers do it.

And this github.com/ramimac/aws-... to understand how common (and old) this kind of attacks are.

Hackers target SSRF bugs in EC2-hosted sites to steal AWS credentials A targeted campaign exploited Server-Side Request Forgery (SSRF) vulnerabilities in websites hosted on AWS EC2 instances to extract EC2 Metadata, which could include Identity and Access Management (IA...

Friendly reminder: IMDSv2 was released in November 2019.

www.bleepingcomputer.com/news/securit...

YouTube video by Prowler How We Saved $70K/Year with an Open Source Private Cloud CA | Paul Schwarzenberger, Q-Solution

The talk is already available in YT: www.youtube.com/watch?v=p2Cb...

Serverless CA on AWS Serverless CA in AWS with FIPS 140-2 level 3 CA key storage and cost typically under $5 per month

"100% serverless Certificate Authority on AWS, only $50/year"

Never thought I would hear all these words together😅

But it's true, go check this amazing project serverlessca.com by @paulschwarzen

Vaya, parece que @colibid también retransmite partidos de futbol de forma "ilegal"...

New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents

"Vibe coders" are in trouble...

www.pillar.security/blog/new-vul...

GitHub Actions and the Pinning Problem: What 100 Security Projects Reveal Only 7/100 popular security projects pin everything. Here’s what I learned digging into the data.

En casa del herrero, cuchillo de palo. 😅

medium.com/@adan.alvare...

Open Cloud Security agenda is out! 🎉

opencloudsecurity.vfairs.com/en/#agenda

Research finds 12,000 ‘Live’ API Keys and Passwords in DeepSeek's Training Data ◆ Truffle Security Co. We scanned Common Crawl - a massive dataset used to train LLMs like DeepSeek - and found ~12,000 hardcoded live API keys and passwords. This highlights a growing issue: LLMs trained on insecure code m...

AWS Root Keys in Front-End Code?! Wtf 🙃

trufflesecurity.com/blog/researc...

Cloud vulnerability teardown: what's important and what you can ignore Breaking down the challenges of vulnerabilities in the cloud and how to identify if your team is at risk

groundedcloudsecurity.substack.com/p/vulnerabil...

Psychological safety is NOT about lack of disagreement.

Psychological safety REQUIRES:

* disagreement and debate
* setting standards for behavior and performance, and enforcing them
* telling people things they don't want to hear
* courage, from the bottom up
* humility, from the top down

Key takeaways for me:
- "False Positives Rate" as the most important metric for measuring detection eng. success
- "Most detections (42%) were custom-built to fit their organization’s unique envs. Vendor-provided come in second at 37%, but few rely on them exclusively."

2025 State of Detection Engineering Report | Anvilogic The 2025 State of Detection Engineering Report reveals key trends & challenges in detection engineering—from AI adoption to skill gaps and data access.

www.anvilogic.com/report/2025-...

I've been accepted as Security AWS Community Builder 🎉 🎉

That means more AWS Cloud Security stuff is coming! 🙌

#AWSCommunity

I personally hate the term "human error" in this context, but I guess thats's what everyone usually uses.

Do you agree with this chatGPT definition of "misconfiguration" in a cloud security context?

How would you define it?

como se entere @sbldevnet.com...

Want to foster a cost-conscious culture in your DevOps team?

We loved this Reddit post (300+ upvotes) about a startup cutting its cloud bill by 40% in weeks by fostering a culture of cost / waste awareness.

AWS IAM User Enumeration Vulnerabilities: CVE-2025-0693 and Security Implications - SSOJet Two critical username enumeration vulnerabilities were identified in the AWS Web Console, exposing all console-enabled Identity and Access Management (IAM) users to potential risk.

blog.ssojet.com/aws-iam-user...

Vamos, que mientras sigas cambiando cosas en su sistema nunca será suficiente, pero siempre valdrá la pena.

"If you focus only on the what, it leads inexorably to an ever growing list of out of date dashboards and alerts and runbooks. Adding how or why signals will help you later on with further investigations. It also aids in building up and maintaining intuition about the system..."

"every change (not just code!) that affects a system either makes the system more observable, or reduces it's observability. [...] If you aren’t moving forward - working to make the system more observable - you are moving backward - allowing the system to become less observable.