Results for “aws-security-hub”

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.

Reviews AWS infrastructure as code and deployed resources against the Well-Architected Framework, generating findings and GitHub issues for remediation.

Provides a structured approach to designing, implementing, and troubleshooting AWS security configurations with best practices and verification checklists.

AWS infrastructure management — EKS, ECR, VPC, RDS, ElastiCache, S3, Route53, ACM, Secrets Manager, CloudWatch, IAM

Continuously monitor multi-cloud environments for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Azure Defender, and GCP Security Command Center.

Hunt for threats in AWS environments using Detective behavior graphs, entity investigation timelines, GuardDuty finding correlation, and automated entity profiling across IAM users, EC2 instances, and IP addresses.

Operates AWS resources directly through the AWS CLI, covering S3, EC2, Lambda, and CloudFormation. Activates when AWS-related terms are mentioned and enforces confirmation for write operations.

Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.

Enumerate AWS resources and identify misconfigurations using ScoutSuite to generate interactive security reports.

Protect API Gateway endpoints with AWS WAF by configuring managed rule groups, rate limiting, bot control, IP reputation filtering, and monitoring.

Answers questions about AWS resources using the local AWS CLI, defaulting to read-only queries and requiring explicit confirmation before any write or destructive action.

Analyzes AWS CloudTrail events and trails, including trail health, API activity, security investigations, resource changes, and event selector audits, with parallel execution and anti-hallucination guardrails.

Deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads, including enabling protection plans, interpreting findings, and building automated response workflows.

Store, retrieve, and automatically rotate credentials, API keys, and other secrets using AWS Secrets Manager.

Manage AWS API Gateway for creating, publishing, and securing REST, HTTP, and WebSocket APIs using CLI commands, SAM templates, and best practices.

Analyze AWS GuardDuty findings, detectors, suppression rules, and member accounts with parallel execution and anti-hallucination guardrails.

Design and implement AWS architectures with best practices for IAM, S3, Lambda, DynamoDB, and serverless deployments.

Specialized skill for building production-ready serverless applications on AWS. Covers Lambda functions, API Gateway, DynamoDB, SQS/SNS event-driven patterns, SAM/CDK deployment, and cold start optimization.

Architect, deploy, and optimize AWS infrastructure avoiding cost explosions and security pitfalls.

Reference for AWS services, architecture patterns, and Well-Architected Framework implementation.

Use when using AWS messaging.

Diagnose and resolve issues with Azure Event Hubs and Service Bus SDKs, including connection failures, authentication errors, message processing problems, and SDK configuration.

Analyze AWS resources and IaC files to generate cost optimization recommendations, creating GitHub issues for each opportunity.

Ingest and process high-throughput event streams using Azure Event Hubs SDK for Python, with support for producers, consumers, and checkpointing.

Specialized skill for building production-ready serverless applications on AWS. Covers Lambda functions, API Gateway, DynamoDB, SQS/SNS event-driven patterns, SAM/CDK deployment, and cold start optimization.

Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations across AWS, Azure, and GCP.

Use Pacu modules for AWS privilege escalation, persistence, and backdooring during authorized penetration tests.

Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.

Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement, with webhook alerting to Slack, Teams, email, or generic HTTP endpoints.

AWS development with infrastructure automation and cloud architecture patterns

Deploy cloud-native deception across AWS, Azure, and GCP using decoy resources that generate high-fidelity alerts when attackers interact with them.

Provides guidance and patterns for AWS development, infrastructure automation, and cloud architecture.

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls, and potential data exfiltration using statistical baselines.

Manages AWS infrastructure across EC2, S3, Lambda, RDS, IAM, CloudFormation, and cost optimization, with guidance on security, monitoring, and operational best practices.