Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Pawel Rzepa
AWS privilege escalation: exploring odd features of the Trust Policy
IAM roles are commonly used, for example, to grant access to AWS service, account, or federated identity. Each role has a document associated with it, which is called a Trust Policy. This document specifies who can assume the role and under what conditions it’s allowed or denied. The Trust Policy is often a subject of special interest among attackers, because it may be configured to work as a backdoor to compromised AWS account or even an entry point for anonymous users.
AWS privilege escalation: exploring odd features of the Trust Policy
IAM roles are commonly used, for example to grant access to AWS service, account or federated identity. Each role has a document associated with it, which is called a Trust Policy. This document specifies who can assume the role and under what conditions it’s allowed or denied. The Trust Policy is often a subject of special interest among attackers, because it may be configured to work as a backdoor to compromised AWS account or even an entry point for anonymous users.
AWS Access Keys Leak in GitHub Repository and Some Improvements in Amazon Reaction
AWS access keys leak via public code repository is a quite known security problem. So common, that popular version control systems offer for free a dedicated service, which looks for hardcoded secrets. Specifically, I refer here to GitHub secret scanning service. Without a doubt, it’s awesome that such a service was released, however, in this blog post I want to answer the following questions: how quickly attackers will detect the key leak?
Passing the AWS Certified Security-Speciality exam
Recently I’ve passed the “AWS Certified Security — Speciality” exam, so I think that’s the best proof that my preparation process was good enough. In this post I want to share my path to pass the “AWS Certified Security — Speciality” exam, including sharing all my notes which I made during the preparation. The scope of the exam is quite general and sometimes you don’t know how deep you should go into some topic.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Pawel
Contact Pawel, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack