Results for “aws-config”

Analyzes AWS WAF web ACLs, rules, IP sets, and logging configurations, and retrieves blocked/allowed request metrics from CloudWatch.

Configure IAM permission boundaries in AWS to delegate role creation to developers while enforcing maximum privilege limits set by the security team.

Analyzes AWS Cognito user pools and identity pools, covering authentication flows, MFA status, app client configuration, password policy, Lambda triggers, and federation setup.

Protect API Gateway endpoints with AWS WAF by configuring managed rule groups, rate limiting, bot control, IP reputation filtering, and monitoring.

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.

Configures HashiCorp Vault dynamic secrets engines for database credentials, AWS IAM keys, and PKI certificates with automatic generation, lease management, and credential rotation.

Reviews AWS infrastructure as code and deployed resources against the Well-Architected Framework, generating findings and GitHub issues for remediation.

Analyze AWS resource health, diagnose issues from CloudWatch logs and metrics, and create a remediation plan for identified problems.

Set up and manage AWS Cognito user pools, identity pools, OAuth flows, and user authentication with CLI commands and Python SDK examples.

Deploy AWS Security Hub as a centralized cloud security posture management platform, aggregate findings from GuardDuty, Inspector, Macie, and third-party tools, enable security standards, configure automated remediation, and build compliance dashboards across multi-account AWS organizations.

Manage AWS API Gateway for creating, publishing, and securing REST, HTTP, and WebSocket APIs using CLI commands, SAM templates, and best practices.

Manage AWS Identity and Access Management for users, roles, policies, and permissions. Create IAM policies, configure cross-account access, set up service roles, troubleshoot permission errors, and enforce least-privilege security.

Aggregate security findings across AWS accounts, enable compliance standards like CIS and PCI DSS, configure automated remediation with EventBridge and Lambda, and create custom security insights for organizational risk management.

Diagnoses AWS architecture issues and reviews Well-Architected pillars using read-only AWS CLI commands, with confirmation required for any changes.

Implement Okta as a centralized identity provider for cloud environments, configure SSO with AWS, Azure, and GCP, deploy phishing-resistant MFA, automate user lifecycle management, and enforce adaptive access policies.

Conduct authorized AWS penetration testing using Pacu to enumerate IAM configurations, discover privilege escalation paths, test credential harvesting, and validate security controls through systematic attack simulation.

Configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) as a centralized security enforcement point with authentication, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection.

Configure identity-aware proxies, micro-segmentation, and continuous verification to replace traditional VPN-based remote access with zero trust network access across AWS, Azure, and GCP.

Configure Hardware Security Modules (HSMs) using the PKCS#11 standard interface for key generation, signing, encryption, and key management with both physical HSMs and SoftHSM2 for development.

Assess cloud configuration risks including IAM privilege escalation, public storage exposure, network over-permissioning, and infrastructure-as-code misconfigurations.

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.

Designs and implements a ransomware-resilient backup strategy following the 3-2-1-1-0 methodology, including asset classification, immutable storage configuration, credential isolation, and automated restore testing.