Locking Down the Security of IAM
summary
Cloud IAM misconfigurations are the primary cloud attack surface, with automated scanners finding assets in 5–7 minutes and common mistakes turning benign policies into exploits. Demonstrated specifics include the EC2 action that remaps instance profile, the danger of star wildcards in policies, using Access Analyzer, S3 bucket policies and VPC endpoints to constrain access, and attribute‑based access control via tags. Fugue shows diagrams, moved its runtime to Lambdas to shrink blast radius, and highlights concrete checks to detect real exploitable gaps.
AI-written summary · about
chapters (9)
- 0:00Cloud security and IAM intro
- 2:05Cloud vs traditional security
- 8:24IAM principles explained
- 17:59IAM policy risks
- 24:42IAM for EC2
- 28:12Resource scoping and ABAC
- 31:41IAM vs resource policies
- 34:51IAM security best practices
- 36:37Q&A
related talks
26mAWS (mis)configuration from an attacker’s-eye view
42mBlowing Up Serverless Security with IAM (And How to Avoid It)
40mWeak Links in Cloud IAM - Never Trust. Always Verify!
47mBringing a Machete to the Amazon
40mBringing a Machete to the Amazon
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
19mMove toward least privilege with IAM Access Analyzer
01h 02mWhy IAM is the new perimeter, and how to govern it