Just 2 hours to go before fwd:cloudsec Europe kicks off here in Berlin! 🇩🇪 We’ve got an incredible lineup of speakers this year covering the latest in cloud security, from IAM and supply chain risks to practical defense strategies.

Since January, I've resumed running. It's part of my New Year's resolution: new gear and a more challenging routine after a seven-year pause and passing the 40-year milestone. I'm now using Strava only to record my activities, and I've found a few cool FOSS initiatives that are game changers.

The lineup for fwd:cloudsec Europe is revealed, presenting a two-day event filled with top-tier presentations on a single track, alongside engaging "Birds of a Feather" discussion sessions. Sponsorship slots remain open. fwdcloudsec.org/conference/... See you there, folks! 🇩🇪

We are living in a unique time where core software technology is ready, but the hardware or device component is lacking. Several times a day, I use an LLM for work-related questions, and at home, I often rely on voice interaction for personal queries.

Sometimes, stats are very painful to read. You're sharing engaging content and OSS AWS projects, yet your blog's most popular post is an eight-year-old paper on interacting with the JIRA API using PowerShell. Rude.

AWS is not magic; it's a compilation of hard work and simplicity, executed at scale. Well known AWS services are in fact, heavily customized OSS. ALB → NGINX ELB → HAProxy EC2 → Xen, KVM DynamoDB → InnoDB Deep Glacier → BD-R optical CloudFront → was NGINX + Squid

ReadOnlyAccess, SecurityAudit, SystemAdministrator ... https://github.com/z0ph/MAMIP/commit/fcfd41a1

Me: Just rolled out a new version of unusd dot cloud for “UN-USD” as in kicking unused dollars out of AWS. Friend: Wait, people really leave money on the table?

Recently, I've added more details to commit messages for MAMIP in response to user feedback on GitHub. You will now be able to see the policy version for each new AWS IAM Managed Policy detection. I hope this Quality of Life improvement benefits other repository users.

This is how I see MCP (Model Context Protocol) nowadays: a way to supercharge your second brain (LLM) with specialized content Neo learned to pilot a helicopter and master martial arts with "I Know Kung Fu" Next, plug the MCP into your first brain. What's your first MCP choice?

Global DNS outage at Cloudflare lasted 62 min due to legacy config accidentally linking 1.1.1.1 routes to a test service. When the test activated, it withdrew all BGP announcements. Classic "dormant config bomb" - bad change in June, triggered in July. blog.cloudflare.com/cloudflare-...

🎵 “CostBusters (AWS)” 🎵 Idle EC2? Volume’s got dust? Who you gonna call? CostsBusters! I ain’t afraid of no waste, I ain’t afraid of no cost haze - let’s chase! When S3’s cold and RDS’s high, Time to hunt those ghosts and say goodbye! ⸻

Back in the Ring! Big thanks to the team at Wiz and especially Scott Piper for putting this together!

We are typically building a Garbage Collector for your cloud environments. For many years, during our consulting engagements with Dorian, we have consistently observed the same recurring pain points: the lack of cost visibility for operational teams. Again and Again.

🚌 Do you know what the bus factor is? It’s the number of people who must suddenly disappear (🚍, lottery win, new job, sick leave) before your project stops. If that number is 1, your luck is riding on one brain.

👀 Peeking behind AWS IAM managed-policy curtains. I’ve been running MAMIP Bot since its first commit (2019-02-10) to mirror every change AWS pushes to its managed-policy repo. Five years of logs reveal clear rhythms from AWS dev teams (two-pizza teams):

🍔 I Spotted the new “BIG ARCH” at McDo, and it hit me: cloud architecture can look just like that burger.

Surviving the “Capital Effect”: TV‑driven traffic spikes on AWS.

When building a bathroom, one of the first things your plumber does after installing the shower drain is a leak test: pour in a large amount of water (5L or more) to check for leaks, ensure the glued joints hold, and verify the slope drains properly.

What’s the point of all this? Most of my professional life has revolved around cloud architecture, security, development, and automation. But sometimes, if we step back and ask why we do what we do (yes, I went full “5 Whys” 🥲), it all boils down to one thing:

I just signed up for another half-marathon. My last big race was the Paris Marathon 2017, eight years ago. Since then, I’ve been running another long race: building a company with side-projects. Running and entrepreneurship share a lot of similar values.

Mark your calendar: fwd:cloudsec Europe 2025 lights up Berlin on September 15-16! This two-day event is a non-profit cloud security conference, and we expect over 350 attendees this year!

Ten years ago, when I began my journey into this mysterious new thing called “the cloud”, I was like little Kid Goku. Naive, Wide-eyed, and incredibly curious about this new way of handling infrastructure. • Spinning up a VM in seconds? • Pay-as-you-go pricing?

Mind the gap… between your AWS bill and what you actually use. This Paris metro-style warning? It’s not just a joke. With my co-founder Dorian, we’ve seen the same issues come up again and again while working with customers:

AWS has unveiled Just-in-Time (JIT) Node Access in AWS Systems Manager, offering dynamic, time-limited entry to EC2, on-premises, and multicloud nodes, all driven by policy-based approvals.

Recently, I've added eight new suspicious activity detection features to my OSS tool: AWS Security Survival Kit. These activities are sourced directly from Stratus Red Team, a @datadoghq Project (cc @christophetd).

We had a great time showing our progress with unusd.cloud to our board of investors. On a serious note, since our journey with this SaaS product started, we've aimed to stay independent, seeing bootstrapping as the key to our strategy.

“The difference between a dream and reality? Just a date.” This quote has been stuck in my head lately. While building unusd with my co-founder Dorian, we kept coming back to it. Not because it sounds cool — but because it hurts a little.

Lambda billing now includes the Init phase – cold starts are no longer “free”. That means: • ❄️ Cold starts now cost you. • 🧠 Code outside your handler (init) will be billed too. • 🧰 Frameworks, SDKs, and extensions (e.g. OTel) could add hidden costs.

Using the AdministratorAccess IAM managed policy for CI/CD pipeline runners is acceptable. Please don’t listen to the warnings of security ayatollahs; they often lack experience in managing production environments.

I guess I'm now defined as a "Tech Dad." 👴 Here's a self-introspection: - Winamp fanboy - Owned a Tamagotchi - Used a T9 keyboard - Had a Sony Minidisc - Favorite game: Zelda - Family's go-to for printing issues - Watched "Back to the Future" 100 times

In 2019, when my stepdaughter went on her first school trip, I received a link to view pictures of their activities. My attention, however, was caught by the URL pattern: (-.com/suivi/12345).

This is why I continue to check Reddit every day. Sorry for the Stevens.

New feature for KYE: Get the list of trusted accounts from AWS Organizations (ListAccounts) API directly. Thanks to Aidan's idea! Link Below ↓

Had an incredible moment visiting the Cloud Computing Museum.

A few months ago, I received a simple email from my online bank about changes to my card insurance. Nothing too exciting… until I hovered over the link. It pointed to a public Amazon S3 bucket.

It's crazy to see how Munch captured this exact moment of life.

In my work, my main quest is to guide customers through their journey in the AWS realm — mostly on infrastructure and security challenges. But like any good adventurer, I also take on side quests.

Ever wonder which vendors have access to your AWS accounts? I've developed this open-source tool to help you review IAM role trust policies and bucket policies. It will compare them against a community list of known AWS accounts from @fwdcloudsec.

Today I learned that SSM Agent auto-update isn't enabled by default. Initially, I was focused on addressing a security vulnerability (path traversal) on customer SSM Agents identified by Cymulate. More details below. ↓ Never mind, this Terraform resource will do the trick.

A few months back, I uncovered a major API flaw in a payroll management platform I used. This vulnerability threatened to expose the sensitive financial data of thousands of businesses (Including mine), primarily freelancers.

I love seeing the tools I've maintained for many years still used by the AWS Security community, continuing to bring value. Users are the best ambassadors. Listen to Rowan explaining the use case for MAMIP. youtube.com/clip/UgkxvM...

Please stop what you’re doing for a moment, and think about what’s happening right now. I’m talking about expertise. In the past, the value of an expert was their knowledge. Then the internet came, knowledge became abundant, and experts had to specialize.

What is your plan to avoid unexpected AWS billing? At @unusd_cloud, we provide daily digest insights on current spending, forecasts, and unused AWS assets. This enables you to make informed decisions. Quickly.

Had a surprising moment during my Louvre visit this afternoon. This Paris #AWSSummit is the perfect moment to exchange on unexpected billing experiences. @dorian__richard and I are present and available to exchange on how to prevent these situations (en français aussi) :)

Joke aside, what kind of guardrails are you using to prevent Denial of Wallet (DoW) and lack of visibility on billed cloud assets? #AWSSummit #AWS

I still write my emails. I'm still using StackOverflow. I still use Google, sometimes. I write my own PR descriptions. My diagrams aren't AI-generated. My LinkedIn photo is a real picture of me. I haven't generated my action figurine yet. Like a psychopath.

Just in! I'll be one of the organizers for the European fwd:cloudsec! So proud to be part of this outstanding, independent cloud security conference. Things to remember: - 📅 September 15-16, 2025 - 📍 Berlin, Germany - 🎫 Tickets: April 22 (first batch) - 📣 CFP: Early May

Our new analytics feature is coming soon to our webapp – built exactly as you asked for! Before, you received reports via web, email, Slack, and Teams. Now, get everything in one powerful view in addition to reports:

Ever wondering what is the actual usage of a specific AWS KMS Key in your Account? Is it safe to schedule for deletion?