Research catalogue
Publications
187 open-access publications for people responsible for cloud control evidence.
From the desk
187 publicationsLet AWS workloads call external services with IAM-issued tokens
IAM outbound identity federation lets an AWS role trade its credentials for a signed JWT instead of storing a vendor API key. AWS controls issuance; the receiving service's claim checks decide what the token is worth.
Identity & access · Amazon Web Services / AWS IAM / AWS STS / Microsoft Entra · By Cloud Security DeskNormalize cloud security logs with OCSF before writing detections
OCSF puts CloudTrail, Azure Activity Log and Google audit records into the same API Activity fields. Detections still depend on the mapping, the schema version and provider semantics that normalization does not erase.
Detection & response · Open Cybersecurity Schema Framework / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskBuild a cryptographic inventory for the post-quantum transition
Record where public-key cryptography protects long-lived data and which library, service or vendor must change it. Then rank entries by function and data lifetime, not by how many RSA keys a scanner found.
Workload security · NIST / CISA / Office of Management and Budget / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskRun code written by AI agents inside a disposable sandbox
Treat agent-generated code as untrusted input. Pick a microVM or user-space kernel boundary, keep egress and credentials off by default, and destroy the session when the user or conversation ends.
AI systems · Amazon Web Services / Microsoft Azure / Google Cloud / Firecracker / gVisor / OWASP · By Cloud Security DeskChoose a multi-region database consistency model before you need failover
The replication model decides which writes survive a Region failure. Compare asynchronous and quorum options in DynamoDB, Aurora, Spanner and Cosmos DB by recovery point, write latency and the reconciliation each one leaves you.
Resilience · Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskScan uploaded files for malware before your application trusts them
Hold every upload where nothing can read it, promote only files with a clean verdict, and decide in advance what happens to the files GuardDuty, Defender or a ClamAV deployment cannot scan.
Workload security · Amazon Web Services / Microsoft Azure / Google Cloud / OWASP · By Cloud Security DeskTrack EU AI Act deadlines after the Digital Omnibus delay
The Digital Omnibus moved high-risk AI duties to December 2027 and August 2028, but prohibitions, AI literacy and Article 50 transparency already apply. See which dates moved and what cloud teams should build now.
AI systems · European Union / European Commission · By Cloud Security DeskBack up a Kubernetes cluster so workloads can actually be restored
A Kubernetes backup has to carry definitions, Secrets and volume data, and the restore depends on identity, keys and images it never held. Plan the layers, the restore order and the checks that prove recovery.
Resilience · Kubernetes / Velero / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskDefend cloud admin accounts against help desk social engineering
Attackers who talk a help desk into resetting MFA inherit every cloud console behind single sign-on. Verify callers properly, shrink what a reset hands over, and alert on the events it leaves.
Detection & response · Microsoft Entra / Okta / Amazon Web Services / CISA / Mandiant · By Cloud Security DeskLimit what Google Cloud principals can reach with principal access boundaries
Allow and deny policies sit on resources. A principal access boundary travels with the identity and limits which projects, folders and organizations it may touch, even where someone else granted it a role.
Identity & access · Google Cloud · By Cloud Security DeskGive AI agents their own identity instead of borrowed user tokens
An agent that replays a user's token is invisible in logs and cannot be revoked on its own. Give it a principal, delegate narrowly through token exchange, and use what Entra, AgentCore and Google now provide.
Identity & access · Microsoft Entra / Amazon Web Services / Google Cloud / IETF / Model Context Protocol · By Cloud Security DeskPrepare a cloud exit strategy that satisfies DORA
DORA requires a tested exit plan for every cloud service that supports a critical or important function. This guide turns that duty into dependency maps, measured data exports, staged tests and register entries that agree.
Resilience · European Commission / European Supervisory Authorities / European Central Bank / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskProtect and recover your AWS root account
Protect AWS root access with MFA, current recovery contacts, separate daily administration, and a clear plan for Organizations member accounts.
Identity & access · AWS · By Cloud Security DeskRemove unused AWS access keys without breaking a job
Review IAM access-key usage, find job dependencies, deactivate safely, and verify final deletion without collecting or exposing secret credentials.
Identity & access · AWS · By Cloud Security DeskChoose and verify CloudWatch Logs retention
Choose CloudWatch Logs retention from supported values, verify the saved setting, and account for delayed deletion, archives, and log-group ownership.
Detection & response · AWS · By Cloud Security DeskMake CloudWatch alarms handle missing data correctly
Choose how CloudWatch alarms treat missing data, understand evaluation surprises, test notifications, and preserve useful alarm evidence.
Detection & response · AWS · By Cloud Security DeskKeep an S3 bucket private with Block Public Access
Enable S3 Block Public Access while preserving approved readers. Review the four settings, private CloudFront origins, and practical access tests.
Workload security · AWS · By Cloud Security DeskRemove public SSH access from an EC2 security group
Remove internet-wide EC2 SSH rules after testing Session Manager or restricted SSH. Check all groups, IPv6, fresh sessions, and recovery access.
Workload security · AWS · By Cloud Security DeskCount tokens before sending a prompt to Amazon Bedrock
Count a Bedrock prompt for the chosen model, check endpoint support, distinguish context and output limits, and verify usage without logging prompts.
AI systems · AWS · By Cloud Security DeskRemove a document from an Amazon Bedrock knowledge base
Retire an S3 document from a Bedrock knowledge base through source changes, sync results, retrieval checks, and review of older application copies.
AI systems · AWS · By Cloud Security DeskRecover a deleted file with S3 Versioning
Recover an S3 object by inspecting retained versions, downloading a known copy, or removing the right delete marker without deleting the recovery data.
Resilience · AWS · By Cloud Security DeskChoose an RDS recovery window you can actually restore
Choose RDS backup retention, inspect the real restorable interval, validate an isolated database restore, and record cleanup and recovery limits.
Resilience · AWS · By Cloud Security DeskGive Google Cloud teams access through IAM groups
Give Google Cloud teams IAM access through owned groups, choose a sensible resource scope, and verify migration and removal with practical checks.
Identity & access · Google Cloud · By Cloud Security DeskConnect to a Google Cloud VM with IAP and OS Login
Connect to a Linux VM through IAP and OS Login, check each permission and network layer, and remove old SSH paths with a tested recovery plan.
Identity & access · Google Cloud · By Cloud Security Desk