New week, new feature on IAMTrail. IAM action context is now built into managed policy views. For each action, you get useful metadata: description, access level, and where it appears. Data comes from iam-dataset by Ian McKay.

Yesterday, AWS inadvertently pushed a test IAM managed policy to production. It was detected by IAMTrail, and this is one of the reason of buiding this tool.

IAMTrail was taking 46 minutes to scan 1,500 AWS managed policies. The culprit: spawning 1,500 separate AWS CLI processes. Each one boots Python, loads boto3, makes one HTTP call, then exits.

Did you know that AWS publishes SNS notifications when changes occur on Amazon GuardDuty? I've been monitoring and archiving this for 4+ years, and it's now available on IAMTrail.

Lately, I've realized that I've been working in the AWS space for nearly 10 years.

IAMTrail now tracks AWS endpoint changes, sourced directly from the Official botocore AWS repository. It reveals service expansions, new region launches, and new partitions - often before they're officially announced.

Since 2019, I've been tracking every AWS Managed Policy change in a Git repository (MAMIP). In the last few months, I've added: - A Landing Page with search capabilities, stats - Known Account Lookup based on the fwdcloudsec dataset - Results of IAM Access Analyzer on these AWS Policies

Just added a new section to the MAMIP webapp to review findings from AWS IAM Access Analyzer on ALL AWS Managed Policies. These capabilities can sometimes yield interesting results and may even spoil upcoming AWS capabilities, etc.

Just added a new feature to MAMIP. You can now search for known AWS accounts from the fwdcloudsec dataset. Single webapp to look up AWS managed policy history, search known AWS account IDs, and more. Give it a try.

I'm in love with your SOUL.md

A few days ago, I found the very first commit of unusd.cloud. Back then it was called Instance-Watcher. The whole logic fit in one screenshot. A simple Python function using boto3 to send a daily HTML table of running EC2 instances across all AWS regions.

Coding in 2026 is like: - Playing Starcraft with "Show me the money". - \devmap q3tourney2 + \god in Q3. - DNKROZ in Duke Nukem. - IDDQD for Doom. Your turn.

Lately, we've added many new features to unusd, thanks to customers' feedback. 1. Navi - Our AI assistant to better understand your cloud spend. 2. Management Reports - C-Level reports (Org Wide). 3. Support of Savings Plans and RIs. 4. Drift Detection with advanced Algorithms.

I knew about WireGuard, but what is Mimic (Avast)? Mimic - Disguises VPN traffic to look like normal web browsing - Designed to bypass firewalls and censorship systems - Slower performance due to traffic disguising techniques - Better for accessing blocked social media in restrictive countries

December is generally a good time for gifts, and I have a special one for you. We are glad to announce fwd:cloudsec Europe 2026: September 7th and 8th - London, UK 🇬🇧 More info to come early 2026. Stay tuned, folks.

Just shipped a compagnon website for MAMIP, the tool that detects change made by AWS on IAM Managed Policy. Let me know what do you think of this first version. I'm considering adding many new features in the next upcoming weeks.

Just 2 hours to go before fwd:cloudsec Europe kicks off here in Berlin! 🇩🇪 We’ve got an incredible lineup of speakers this year covering the latest in cloud security, from IAM and supply chain risks to practical defense strategies.

Since January, I've resumed running. It's part of my New Year's resolution: new gear and a more challenging routine after a seven-year pause and passing the 40-year milestone. I'm now using Strava only to record my activities, and I've found a few cool FOSS initiatives that are game changers.

The lineup for fwd:cloudsec Europe is revealed, presenting a two-day event filled with top-tier presentations on a single track, alongside engaging "Birds of a Feather" discussion sessions. Sponsorship slots remain open. fwdcloudsec.org/conference/... See you there, folks! 🇩🇪

We are living in a unique time where core software technology is ready, but the hardware or device component is lacking. Several times a day, I use an LLM for work-related questions, and at home, I often rely on voice interaction for personal queries.

Sometimes, stats are very painful to read. You're sharing engaging content and OSS AWS projects, yet your blog's most popular post is an eight-year-old paper on interacting with the JIRA API using PowerShell. Rude.

AWS is not magic; it's a compilation of hard work and simplicity, executed at scale. Well known AWS services are in fact, heavily customized OSS. ALB → NGINX ELB → HAProxy EC2 → Xen, KVM DynamoDB → InnoDB Deep Glacier → BD-R optical CloudFront → was NGINX + Squid

ReadOnlyAccess, SecurityAudit, SystemAdministrator ... https://github.com/z0ph/MAMIP/commit/fcfd41a1

Me: Just rolled out a new version of unusd dot cloud for “UN-USD” as in kicking unused dollars out of AWS. Friend: Wait, people really leave money on the table?

Recently, I've added more details to commit messages for MAMIP in response to user feedback on GitHub. You will now be able to see the policy version for each new AWS IAM Managed Policy detection. I hope this Quality of Life improvement benefits other repository users.

This is how I see MCP (Model Context Protocol) nowadays: a way to supercharge your second brain (LLM) with specialized content Neo learned to pilot a helicopter and master martial arts with "I Know Kung Fu" Next, plug the MCP into your first brain. What's your first MCP choice?

Global DNS outage at Cloudflare lasted 62 min due to legacy config accidentally linking 1.1.1.1 routes to a test service. When the test activated, it withdrew all BGP announcements. Classic "dormant config bomb" - bad change in June, triggered in July. blog.cloudflare.com/cloudflare-...

🎵 “CostBusters (AWS)” 🎵 Idle EC2? Volume’s got dust? Who you gonna call? CostsBusters! I ain’t afraid of no waste, I ain’t afraid of no cost haze - let’s chase! When S3’s cold and RDS’s high, Time to hunt those ghosts and say goodbye! ⸻

Back in the Ring! Big thanks to the team at Wiz and especially Scott Piper for putting this together!

We are typically building a Garbage Collector for your cloud environments. For many years, during our consulting engagements with Dorian, we have consistently observed the same recurring pain points: the lack of cost visibility for operational teams. Again and Again.

🚌 Do you know what the bus factor is? It’s the number of people who must suddenly disappear (🚍, lottery win, new job, sick leave) before your project stops. If that number is 1, your luck is riding on one brain.

👀 Peeking behind AWS IAM managed-policy curtains. I’ve been running MAMIP Bot since its first commit (2019-02-10) to mirror every change AWS pushes to its managed-policy repo. Five years of logs reveal clear rhythms from AWS dev teams (two-pizza teams):

🍔 I Spotted the new “BIG ARCH” at McDo, and it hit me: cloud architecture can look just like that burger.

Surviving the “Capital Effect”: TV‑driven traffic spikes on AWS.

When building a bathroom, one of the first things your plumber does after installing the shower drain is a leak test: pour in a large amount of water (5L or more) to check for leaks, ensure the glued joints hold, and verify the slope drains properly.

What’s the point of all this? Most of my professional life has revolved around cloud architecture, security, development, and automation. But sometimes, if we step back and ask why we do what we do (yes, I went full “5 Whys” 🥲), it all boils down to one thing:

I just signed up for another half-marathon. My last big race was the Paris Marathon 2017, eight years ago. Since then, I’ve been running another long race: building a company with side-projects. Running and entrepreneurship share a lot of similar values.

Mark your calendar: fwd:cloudsec Europe 2025 lights up Berlin on September 15-16! This two-day event is a non-profit cloud security conference, and we expect over 350 attendees this year!

Ten years ago, when I began my journey into this mysterious new thing called “the cloud”, I was like little Kid Goku. Naive, Wide-eyed, and incredibly curious about this new way of handling infrastructure. • Spinning up a VM in seconds? • Pay-as-you-go pricing?

Mind the gap… between your AWS bill and what you actually use. This Paris metro-style warning? It’s not just a joke. With my co-founder Dorian, we’ve seen the same issues come up again and again while working with customers:

AWS has unveiled Just-in-Time (JIT) Node Access in AWS Systems Manager, offering dynamic, time-limited entry to EC2, on-premises, and multicloud nodes, all driven by policy-based approvals.

Recently, I've added eight new suspicious activity detection features to my OSS tool: AWS Security Survival Kit. These activities are sourced directly from Stratus Red Team, a @datadoghq Project (cc @christophetd).

We had a great time showing our progress with unusd.cloud to our board of investors. On a serious note, since our journey with this SaaS product started, we've aimed to stay independent, seeing bootstrapping as the key to our strategy.

“The difference between a dream and reality? Just a date.” This quote has been stuck in my head lately. While building unusd with my co-founder Dorian, we kept coming back to it. Not because it sounds cool — but because it hurts a little.

Lambda billing now includes the Init phase – cold starts are no longer “free”. That means: • ❄️ Cold starts now cost you. • 🧠 Code outside your handler (init) will be billed too. • 🧰 Frameworks, SDKs, and extensions (e.g. OTel) could add hidden costs.

Using the AdministratorAccess IAM managed policy for CI/CD pipeline runners is acceptable. Please don’t listen to the warnings of security ayatollahs; they often lack experience in managing production environments.

I guess I'm now defined as a "Tech Dad." 👴 Here's a self-introspection: - Winamp fanboy - Owned a Tamagotchi - Used a T9 keyboard - Had a Sony Minidisc - Favorite game: Zelda - Family's go-to for printing issues - Watched "Back to the Future" 100 times

In 2019, when my stepdaughter went on her first school trip, I received a link to view pictures of their activities. My attention, however, was caught by the URL pattern: (-.com/suivi/12345).

This is why I continue to check Reddit every day. Sorry for the Stevens.

New feature for KYE: Get the list of trusted accounts from AWS Organizations (ListAccounts) API directly. Thanks to Aidan's idea! Link Below ↓