Father of two boys, guitar and uke player. Identity, GenAI, and security architect. My opinions are my own.
Chicago, IL
Joined March 2014
- Tweets905
- Following309
- Followers1.1K
- Likes1.4K
Pinned Tweet
🔐If you ever need to call the AWS IAM or STS APIs, or want a snapshot of your IAM resources (users, roles, and policies), or just want to learn more on IAM's behavior, check out my two-part blog on this topic! aws.amazon.com/blogs/securit…
It's these types of exploits that make me extra careful when reviewing the security apps that use LLMs.
Hey @canva, you told us that you wouldn't answer security questions "without purchase of the Enterprise version". Is this reflective of your attitude towards customers who care about security, privacy, and compliance especially with the concerns everyone has around AI? Do better!
If this isn't reflective of your sales culture, then I'd appreciate a DM on how we can resolve this. My job is to review vendors on their AI-related security controls, and up to now all vendors have willingly complied, enterprise version or not. @canva thoughts?
I'd recommend this anyone needed to skill up on AWS IAM!
This Post is from an account that no longer exists. Learn more
While not working on ☁️IAM security🔒, I've had to dive in Microsoft Copilot & Copilot Studio security. Copilot Studio is a no/low-code agent and chatbot platform with many integrations to your MS tenant, SNOW, Facebook, etc. Make sure your developers configure this securely!
a short summary of all new attack vectors, lol techniques and tools we published at bh/dc (400 words)
labs.zenity.io/p/summary-zen…
A 🪲 bug with Google Search's AI Overview feature? Either way its completely incoherent.... in repudiateas in scowlas in spurnas in turn downas..!
Michael Chan retweeted
ICYMI!
In mid-2024, we're enhancing your sign-in experience. 🌟 Expect a new UI for root & IAM users and an updated switch role page. Improved navigation for a seamless sign in experience.
💡 Discover more in our latest blog: go.aws/3v2jHj7
Happy holidays everyone! Wishing you all a happy and secure Christmas season. Gingerbread house kit courtesy of @wiz_io and @SolvangBakery.
Michael Chan retweeted
Awesome to see this in the docs now! Also check out this great session from @colmmacc where he covers FAS: youtube.com/watch?v=4J8REvs7…
👉For those who want more on AWS security internals, we finally have a great page describing Forward Access Sessions, the vehicle by which many AWS services does things on behalf of you. docs.aws.amazon.com/IAM/late… @AWSIdentity
👉For those who want more on AWS security internals, we finally have a great page describing Forward Access Sessions, the vehicle by which many AWS services does things on behalf of you. docs.aws.amazon.com/IAM/late… @AWSIdentity
Michael Chan retweeted
As of next year, #google will require premium subscriptions for things like IAM Recommender, Role Insights, etc.
This is the OPPOSITE of their mantra calling for shared fate instead of the shared responsibility model.
A massive loss in credibility.
Policy Intelligence update on September 28, 2023 cloud.google.com/policy-inte… #googlecloud After January 15, 2024, some Policy Intelligence features will only be available for customers with organization-level activations of Security 1/2
Michael Chan retweeted
Big pricing change to a valuable GCP security feature for least-privilege IAM. Requiring the org-level SCC Premium bundle instead of a pay-as-you-go per-service price will be prohibitively expensive and detrimental to security for many customers in the long run. @philvenables
Policy Intelligence update on September 28, 2023 cloud.google.com/policy-inte… #googlecloud After January 15, 2024, some Policy Intelligence features will only be available for customers with organization-level activations of Security 1/2
😠Wondering today why @googlecloud charges for security features that @awscloud gives away for free. Shouldn't customer security be paramount?
"What will require Security Command Center Premium:
IAM Recommender, including lateral movement insights, role recommendations ..."
"What will require SCC Premium:
IAM Recommender, including lateral movement insights, role recommendations for non-basic roles, recommendations for custom roles, and recommendation for Google Cloud Storage buckets.
Policy Analyzer at scale (above 20 queries per day)."
Shame on you @googlecloud. Your competitor's AWS IAM Access Analyzer is free, and will likely remain so. If you cared about customer security, you're certainly not showing it.
Coming from someone reviewing the security controls that can be enabled in Azure, this isn't too comforting. AWS I know has a strong security culture, but much less sure about Microsoft.
Google's use of the vuln list cloudvulndb.org/ to claim better security than other CSP's is a classic example of misusing statistics by not understanding how the data has been curated and represented. @0xdabbad00
Hey @alexadevs, my Alexa skill has earned $$ the past few months, but it's never been credited to my bank account even though I've provided the info as asked in the developer console. Can you assist? I hope no other devs have this issue!
👉For all you AWS customers that also have to understand GCP lAM lingo, here's a quick clarification on the terminology you need to understand. Especially since an GCP role is not equivalent to an AWS role (a GCP service account is the most equivalent): kattraxler.github.io/
And if you stay up late worrying about AWS IAM users and their long-lived credentials, well look no further! GCP has the same, and they're called service account keys. In GCP, though, you now can set an expiration date, not that you should depend on this: cloud.google.com/iam/docs/se…