Cloud on zoph.me, AWS Cloud Security and Indie Consulting

AWS CloudFormation Phishing Attack: A Growing Threat

Mon, 10 Feb 2025 13:37:00 +0200

Attackers abuse CloudFormation Launch Stack URLs to phish AWS account takeover via admin IAM roles. Anatomy of the attack, detection signals, and blue team controls.

AWS Mixtape: Summer 2024

Sun, 01 Sep 2024 13:37:00 +0200

Curated AWS and cloud security reading from summer 2024: IAM tooling, S3 block storage history, Route 53 best practices, over-engineering, and Wiz security migrations.

Thoughts on Indie AWS Consulting in 2025

Sun, 25 Aug 2024 13:37:00 +0200

After 5 years running an indie AWS consulting boutique: market saturation, falling daily rates, why you should specialize in a niche, and how to diversify revenue.

Proxy Logs: Preserving Client IPs in AWS PrivateLink

Sun, 18 Aug 2024 13:37:00 +0200

AWS PrivateLink hides the source client IP from your backend. Here is how to enable Proxy Protocol v2 on Squid behind an NLB to preserve real client IPs in access logs.

Over-Architecting AWS: Why Your Internal App Is Not Netflix

Sun, 04 Aug 2024 13:37:00 +0200

Most AWS workloads do not need event-driven Kubernetes. Start simple, work backwards from RTO/RPO, ignore reversibility. You are not Netflix. Keep architecture dead simple.

AWS Starter Kit - 2020 Edition

Fri, 10 Jul 2020 13:37:00 +0200

This post was updated in July 2020. It was originally my first post on this blog in December 2016. 👴

I’m often asked by many colleagues, friends, or Twitter followers where to start with Amazon Web Services (AWS). In this post, I will try to explain where you should start in 2020.

I’ll try to write this post as I wish I had when I got into this technology in 2016.

[MAMIP] Monitor AWS Managed IAM Policies

Sat, 22 Feb 2020 13:37:00 +0200

This article was originally posted in September 2019. Updated in February 2020.

Disclaimer

Thanks to @0xdabbad00 from SummitRoute for the original idea and jq parsing.

Purpose

When your production workloads rely on AWS IAM Managed Policies (don’t do this), you will need to be notified when changes occur behind the scenes. It’s also interesting to monitor new AWS service releases ahead of the announcements to get spoiled.

This pet project automates the retrieval (every 4 hours) of new AWS Managed IAM Policies to make it easier to monitor and get alerted when changes occur (by AWS), using the “Watch” feature on GitHub, RSS or a dedicated Twitter Account.

Easily reduce by 70% your AWS Fargate bills

Sun, 16 Feb 2020 13:37:00 +0200

Quick post today about cost saving on AWS. As you know, two of my preferred subjects on Public Cloud are Security and FinOps!

Recently, AWS introduced a way to reduce AWS bills by up to 70% using Spot instances with the AWS Fargate service.

It’s really easy to use. If your workload is interruption-proof, batch jobs, or CI/CD containers, don’t hesitate to use it to drastically reduce your workload costs.

Using Terraform, you just have to specify capacity_providers and/or default_capacity_provider_strategy on your aws_ecs_cluster resource.

CloudWatch Synthetics - Canary testing

Sun, 02 Feb 2020 13:37:00 +0200

Canary What?

In software testing, a canary (also called a canary test) is a push of programming code changes to a small number of end-users who have not volunteered to test anything. The goal of a canary test is to make sure code changes are transparent and work in a real-world environment.

Canary tests, which are often automated, are run after testing in a sandbox environment has been completed. Because the canary is only pushed to a small number of users, its impact is relatively small should the new code prove to be buggy and changes can be reversed quickly.

On being Independent

Wed, 01 Jan 2020 13:37:00 +0200

In December 2019, I’ve decided to switch from a long-time (15 years) habit of Full-Time Employee (FTE) contracts to running my own business as an Independent AWS Cloud Architect.

This decision came to me after a few disappointments from my past experiences as a traditional employee/consultant, and I had been thinking about this switch for several years.

It was the perfect time for me to start this new challenge:

I’ve no plan to take a homebuyer’s loan for the next few years.
I’m confident regarding my AWS skills now, even if I still have a lot to learn.
My network is now large enough to easily get new opportunities (friends, ex-colleagues, acquaintances, social network).
My wife is working and has an FTE job.

I will focus on value delivery to my customers as a freelance consultant, in the following areas: Modern Cloud Architecture Design, Security Assessments, Reliability, Automation, Cost-Effectiveness, Training and so on.

[FR] Re:Invent 2018

Thu, 27 Dec 2018 22:31:32 +0200

Retour sur une semaine incroyable et riche en annonces comme à l’accoutumée pour cette nouvelle édition du salon annuel Amazon Web Services (AWS) à Las Vegas.

Dans cet article, nous allons revenir sur les principaux lancements de cette année, des plus importants aux plus inattendus.

Quelques chiffres avant de commencer, AWS est un business avec un CA de 27Mds$, avec une croissance de 46-49%. Cette année, le re:Invent c’est 50 000 participants annoncés, répartis sur les 5 principaux casinos de Las Vegas.

Stress website with a Beehive (with machineguns 🔫)

Sun, 18 Mar 2018 22:31:32 +0200

Warning I deny any responsibility for using this article to launch an assault on a website that you don’t own.

TL;DR

In this article, you will find a procedure to launch a distributed load test of ApacheBench (AB) on your website. I will use BeesWithMachineGuns.

Requirements

Boto / awscli
Python 2.6 - 3.6
paramiko

Installation

aws configure with your credentials
sudo pip install https://github.com/newsapps/beeswithmachineguns/archive/master.zip

Launch ssh-agent, add your key:

Copy your EC2 ssh-key pair to your instance, in /home/ec2-user/.ssh/. This key will be used to launch bees.

[FR] Backup Jeedom sur AWS S3

Fri, 12 Jan 2018 22:31:32 +0200

Dans cet article, nous allons voir comment sauvegarder vos backups Jeedom dans le Cloud Amazon.

Ok, mais combien ça coûte Amazon Web Services (AWS) ?

Je pars du principe que vous avez un backup par jour pendant 1 an à sauvegarder, chaque backup fait 100 Mo (le double de ma sauvegarde actuelle)

La première année pendant le FreeTier : 0,74$/mois
La deuxième année après le FreeTier : 0,86$/mois

Evidemment il n’y a aucun intérêt de garder autant de versions, un mois est à mon sens largement suffisant.

AWS Starter Kit

Tue, 13 Dec 2016 13:37:00 +0200

This post was updated on 2020-07-11.

You will find in this post a few links and videos to help you on your journey to AWS Cloud.