https://opensourceom.org/blog/ Cloud security, CSPM, CNAPP, and attack-path articles from OpenSourceOM. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/aws-data-perimeter/ https://opensourceom.org/blog/aws-data-perimeter/ AWS data perimeter means three different denies: other orgs on your resources, your callers off your network, and your callers on other orgs' resources. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/aws-iam-permission-boundaries/ https://opensourceom.org/blog/aws-iam-permission-boundaries/ An IAM permission boundary is the maximum a role can have. It grants nothing. Condition CreateRole on it, and deny deleting the boundary. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/aws-iam-roles-anywhere/ https://opensourceom.org/blog/aws-iam-roles-anywhere/ IAM Roles Anywhere exchanges an X.509 certificate for short-lived STS credentials. Trust anchors, CN conditions, and revoked certs that still work. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/azure-lighthouse-delegated-access/ https://opensourceom.org/blog/azure-lighthouse-delegated-access/ Azure Lighthouse is cross-tenant RBAC, not a guest user. Eligible authorizations, roles to refuse, and deny assignments that still bind the partner. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/ec2-instance-connect-endpoint/ https://opensourceom.org/blog/ec2-instance-connect-endpoint/ EC2 Instance Connect Endpoint is private SSH: OpenTunnel IAM, the endpoint security group as source, and when Session Manager is the better control. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/eks-pod-identity-vs-irsa/ https://opensourceom.org/blog/eks-pod-identity-vs-irsa/ EKS Pod Identity binds an IAM role to a namespace and service account. Trust policy, leftover IRSA annotations, and an agent that fails closed. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/gitlab-ci-oidc-aws-iam/ https://opensourceom.org/blog/gitlab-ci-oidc-aws-iam/ GitLab CI OIDC to AWS uses project_path and ref in sub, not a GitHub-style repo claim. Protect prod with ref_protected and a narrow StringEquals. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/kubernetes-ephemeral-containers/ https://opensourceom.org/blog/kubernetes-ephemeral-containers/ kubectl debug patches pods/ephemeralcontainers, which many Pod CREATE policies never see. RBAC, node debug pods, and the shared process namespace. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/kubernetes-user-namespaces/ https://opensourceom.org/blog/kubernetes-user-namespaces/ Kubernetes user namespaces set hostUsers false so container root is not host root. On by default since 1.33, and why hostPath and seccomp still matter. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/s3-object-lock-retention/ https://opensourceom.org/blog/s3-object-lock-retention/ S3 Object Lock is a retention ceiling: governance can be bypassed, compliance cannot, and a delete marker hides versions it does not remove. Fri, 25 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/azure-pim-eligible-vs-active/ https://opensourceom.org/blog/azure-pim-eligible-vs-active/ Standing Owner is the finding; eligible is still a path. Approval, MFA on activate, Graph/PIM APIs, and how to put eligible edges on a security graph. Tue, 22 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/kubernetes-projected-service-account-tokens/ https://opensourceom.org/blog/kubernetes-projected-service-account-tokens/ Replace never-expiring Secret-based service account tokens with TokenRequest projected volumes: audiences, expiry, pod-bound tokens, and how IRSA consumes them. Tue, 22 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/kubernetes-validating-admission-policy/ https://opensourceom.org/blog/kubernetes-validating-admission-policy/ In-process CEL for deny-only checks; keep Kyverno or Gatekeeper for mutation. FailurePolicy Fail vs Ignore, parameter resources, and 1.30+ GA. Tue, 22 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/agentless-vs-agent-cloud-security/ https://opensourceom.org/blog/agentless-vs-agent-cloud-security/ API snapshots see IAM and exposure; agents see processes and ransomware. Blind spots of both, and a hybrid that does not double-ticket every CVE. Fri, 18 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/aws-imdsv2-hop-limit-enforcement/ https://opensourceom.org/blog/aws-imdsv2-hop-limit-enforcement/ Hop limit 1 blocks SSRF and container theft of instance-profile keys. CLI, launch templates, account defaults, SCPs, and the hop-limit-2 failure modes. Fri, 18 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/cspm-vs-cnapp-whats-the-difference/ https://opensourceom.org/blog/cspm-vs-cnapp-whats-the-difference/ Compare CSPM vs CNAPP for cloud security. Learn how attack path analysis and security graphs help teams prioritize misconfigurations and vulnerabilities that attackers can actually reach. Fri, 18 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/gcp-custom-org-policy-constraints/ https://opensourceom.org/blog/gcp-custom-org-policy-constraints/ Custom CEL constraints when IAM cannot express a resource-shape rule. Dry-run, managed vs custom, and the failure modes that silently skip evaluation. Fri, 18 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/gcp-iam-deny-policies-guide/ https://opensourceom.org/blog/gcp-iam-deny-policies-guide/ Deny evaluates after the allow union—even Owner. Attachment points, a key-creation deny you can test, lockout paths, and exceptions that do not become standing admin. Fri, 18 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/toxic-combinations-aws-azure/ https://opensourceom.org/blog/toxic-combinations-aws-azure/ Learn what toxic combination cloud security means in AWS and Azure — misconfiguration pairs that create real attack paths, and how security graphs detect them. Fri, 18 Sep 2026 00:00:00 GMT https://opensourceom.org/blog/aws-documentdb-security-guide/ https://opensourceom.org/blog/aws-documentdb-security-guide/ Harden Amazon DocumentDB with TLS 1.2, encryption at rest, no public access, scoped IAM or secrets, audit logs, and snapshot controls—then verify no internet path to the cluster. Sun, 30 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-s3-bucket-security-hardening/ https://opensourceom.org/blog/aws-s3-bucket-security-hardening/ Harden AWS S3 with account-level Block Public Access, bucket policies over ACLs, KMS encryption, VPC endpoints, and Access Analyzer—then rank leftover risk by attack path. Sun, 30 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-sagemaker-security-guide/ https://opensourceom.org/blog/aws-sagemaker-security-guide/ Lock down SageMaker Studio, training jobs, and endpoints: VPC-only, scoped execution roles, no root on notebooks, encrypted data, and private model APIs. Sun, 30 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/azure-application-gateway-waf/ https://opensourceom.org/blog/azure-application-gateway-waf/ Run Application Gateway WAF_v2 in Prevention with OWASP CRS, custom rules, and Log Analytics—without treating WAF as authentication or network segmentation. Sun, 30 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/cloud-native-application-security/ https://opensourceom.org/blog/cloud-native-application-security/ Seven design patterns for securing cloud-native apps on Kubernetes and serverless—supply chain, identity, network, secrets, APIs, runtime, and attack-path context. Sun, 30 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/csa-star-cloud-security-compliance/ https://opensourceom.org/blog/csa-star-cloud-security-compliance/ Map CSA STAR (CAIQ, Level 1–2, CCM) to AWS, Azure, and GCP controls you already run—and use attack-path evidence so auditors see reachable risk, not screenshot binders. Sun, 30 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-cloudfront-security-guide/ https://opensourceom.org/blog/aws-cloudfront-security-guide/ Amazon CloudFront security that actually holds: Origin Access Control instead of OAI, HTTPS only, S3 bucket policies that deny non-CloudFront, WAF attachment, and the bypass of hitting the bucket URL directly. Sat, 29 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-eventbridge-security-guide/ https://opensourceom.org/blog/aws-eventbridge-security-guide/ Amazon EventBridge security: default-bus vs custom bus resource policies, cross-account PutEvents, API destinations and connection secrets, and encryption that does not cover the event you already leaked to a partner. Sat, 29 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-glue-security-guide/ https://opensourceom.org/blog/aws-glue-security-guide/ AWS Glue security for ETL: least-privilege job roles, Lake Formation vs IAM, connection credentials, catalog encryption, and why a crawler role that can s3:* is an exfil path. Sat, 29 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-lambda-security-guide/ https://opensourceom.org/blog/aws-lambda-security-guide/ AWS Lambda security that matters in prod: execution-role blast radius, resource-based policies, Function URL auth, public layers, and env vars that are still plaintext secrets. Sat, 29 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-rds-security-guide/ https://opensourceom.org/blog/aws-rds-security-guide/ Lock down Amazon RDS: KMS at rest, TLS in transit, IAM database auth, PubliclyAccessible false, snapshot exposure, and the security-group mistakes that still publish Postgres to 0.0.0.0/0. Sat, 29 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-security-best-practices-2026/ https://opensourceom.org/blog/aws-security-best-practices-2026/ Org-first AWS hardening: Identity Center over access keys, SCPs that actually deny, org CloudTrail, S3 Block Public Access, and the failure modes that keep those controls from working. Sat, 29 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/gcp-cloud-armor-security-guide/ https://opensourceom.org/blog/gcp-cloud-armor-security-guide/ Set up Cloud Armor on a Google Cloud load balancer: L3/L4 DDoS, preconfigured OWASP WAF rules, rate limiting, Adaptive Protection, Terraform, and preview mode. Sat, 29 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aspm-vs-cnapp/ https://opensourceom.org/blog/aspm-vs-cnapp/ ASPM vs CNAPP is not two names for the same platform. ASPM inventories apps, APIs, and code risk; CNAPP inventories cloud resources and IAM. Shared runtime is where the queues collide. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/attack-path-analysis-cloud-security/ https://opensourceom.org/blog/attack-path-analysis-cloud-security/ Learn what attack path analysis is, how cloud attack paths are modeled in a security graph, and why graph-native CNAPP tools prioritize reachable risk over flat alert lists. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-control-tower-detective-guardrails/ https://opensourceom.org/blog/aws-control-tower-detective-guardrails/ Control Tower detective guardrails are Config rules, not SCPs. Skip duplicates of preventive policies, fix recorder ownership, and map remaining noncompliant resources onto attack paths. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-ebs-snapshot-public-exposure/ https://opensourceom.org/blog/aws-ebs-snapshot-public-exposure/ Public EBS snapshot exposure is CreateVolumePermission group=all, not a bucket ACL. Account-level block-all-sharing, hunt commands, and the AMI side channel Block Public Access for snapshots does not close. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-iam-access-analyzer-unused-access/ https://opensourceom.org/blog/aws-iam-access-analyzer-unused-access/ IAM Access Analyzer unused access is a paid org analyzer, not the free external-access findings. Delegated admin, service-linked noise, tracking-period traps, and turning findings into permission boundaries. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-resource-control-policies-rcp/ https://opensourceom.org/blog/aws-resource-control-policies-rcp/ AWS resource control policies are Organizations resource-based guardrails: they cap what any caller—including principals outside the org—can do to member-account resources. SCP vs RCP vs IAM, a public-S3 deny, sandbox OU tests. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-verified-permissions-cedar/ https://opensourceom.org/blog/aws-verified-permissions-cedar/ Amazon Verified Permissions Cedar is application authorization, not IAM and not CSPM. Policy shape, when AVP is the wrong tool, and mapping API actions to the same identities a security graph already has. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/aws-vpc-endpoints-vs-nat-security/ https://opensourceom.org/blog/aws-vpc-endpoints-vs-nat-security/ VPC endpoint vs NAT gateway security is not a cost conversation. NAT still egresses to public AWS APIs; gateway vs interface endpoints; endpoint policies as IAM; put S3 and STS on private paths first. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/azure-cspm-implementation-guide/ https://opensourceom.org/blog/azure-cspm-implementation-guide/ Turn on Defender for Cloud CSPM at the management group, assign MCSB with Deny, export to Log Analytics, and avoid Secure Score theater and exemption rot. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/azure-federated-identity-credentials/ https://opensourceom.org/blog/azure-federated-identity-credentials/ Replace app-registration client secrets in GitHub Actions with Azure federated identity credentials: OIDC issuer, subject, audience, leftover secrets, and az commands. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/azure-landing-zone-deny-assignments/ https://opensourceom.org/blog/azure-landing-zone-deny-assignments/ CAF-style deny assignments vs Policy Deny, platform vs app landing zones, break-glass, and debugging “I am Owner but cannot delete.” Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/azure-private-endpoint-dns-gotchas/ https://opensourceom.org/blog/azure-private-endpoint-dns-gotchas/ Private endpoints that still resolve to public IPs: zone linking, split-brain resolvers, missing privatelink zones, and Storage/Key Vault examples you can query. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/azure-resource-graph-security-queries/ https://opensourceom.org/blog/azure-resource-graph-security-queries/ Use Azure Resource Graph KQL for public IPs and open NSGs at management-group scope, when ARG beats Policy, and how to export hits into a security graph. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/blast-radius-analysis-cloud-iam/ https://opensourceom.org/blog/blast-radius-analysis-cloud-iam/ Walk blast radius for one AWS IAM role and one Azure managed identity: define admin-equivalent, then shrink that radius before you patch CVEs. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/cdr-cloud-detection-response/ https://opensourceom.org/blog/cdr-cloud-detection-response/ CDR versus CSPM: state versus events, the telemetry you actually need, detections that require graph context, and where GuardDuty, SCC, and Defender fit. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/ciem-explained-for-cloud-teams/ https://opensourceom.org/blog/ciem-explained-for-cloud-teams/ What is CIEM (Cloud Infrastructure Entitlement Management)? Learn how cloud identity entitlement management fits into CNAPP, CSPM, and attack path analysis. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/cloud-security-exception-process/ https://opensourceom.org/blog/cloud-security-exception-process/ A cloud security exception process with owners, expiry, and compensating controls—time-boxed IAM and security groups, plus Policy exemptions that actually end. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/cloud-security-graph-vs-cmdb/ https://opensourceom.org/blog/cloud-security-graph-vs-cmdb/ Why a CMDB is inventory rather than risk: edges it omits, sync lag as a security bug, and when you still need a CMDB beside a security graph. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/cloud-security-kpis-for-boards/ https://opensourceom.org/blog/cloud-security-kpis-for-boards/ Board-ready cloud security KPIs: stop reporting raw criticals, track internet-facing count, path-open time, exception age, and a sample monthly pack. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/cloudformation-hooks-security/ https://opensourceom.org/blog/cloudformation-hooks-security/ CloudFormation Hooks versus Config and SCPs: a deny-public-S3 hook on create, the IAM role the hook runs as, and the failure modes that fail open. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/cosign-keyless-sigstore-k8s/ https://opensourceom.org/blog/cosign-keyless-sigstore-k8s/ Cosign keyless signing with Fulcio and Rekor, admission via Kyverno or VAP, and the air-gap limits that force you back to keys on Kubernetes. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/cross-cloud-identity-impersonation/ https://opensourceom.org/blog/cross-cloud-identity-impersonation/ Cross-cloud identity impersonation: federation trust as a graph edge, confused-deputy conditions, workload identity across AWS, GCP, and Azure. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/cspm-vs-ciem-vs-cnapp/ https://opensourceom.org/blog/cspm-vs-ciem-vs-cnapp/ CSPM, CIEM, and CNAPP answer three different questions. Use this one-page decision table to stop double-ticketing and choose buy versus compose. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/dspm-vs-ciem-data-identity/ https://opensourceom.org/blog/dspm-vs-ciem-data-identity/ DSPM vs CIEM splits classification of data from classification of principals. Empty public buckets, private buckets with Owner ACL, and IAM that ignores data tags are different failures. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/gcp-iam-security-hardening/ https://opensourceom.org/blog/gcp-iam-security-hardening/ Stop using basic roles and JSON keys: folder inheritance, IAM deny policies, organization constraints, Workload Identity Federation, and the default Compute SA. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/gcp-principal-access-boundary/ https://opensourceom.org/blog/gcp-principal-access-boundary/ Principal Access Boundary policies cap which resources a principal can touch: PAB vs IAM deny vs org policy, a contractor example, and how to test before binding. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/gcp-vpc-sc-dry-run-enforced/ https://opensourceom.org/blog/gcp-vpc-sc-dry-run-enforced/ Operator sequence for VPC Service Controls: perimeter vs IAM, dry-run logs, Cloud Build false positives, then a staged enforce. This is not a WAF. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/gcp-workforce-identity-federation/ https://opensourceom.org/blog/gcp-workforce-identity-federation/ Workforce Identity Federation maps IdP groups to GCP IAM for humans—no Cloud Identity user required. Not Workload Identity Federation (that is CI and GKE). Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/github-actions-oidc-aws-iam/ https://opensourceom.org/blog/github-actions-oidc-aws-iam/ GitHub Actions OIDC to AWS: trust policy sub and aud conditions, environment protection, wildcard subject claims, and how to debug InvalidIdentityToken. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/gitlab-ci-workload-identity-gcp/ https://opensourceom.org/blog/gitlab-ci-workload-identity-gcp/ GitLab CI Workload Identity Federation: attribute mapping, protected branches, leftover JSON keys, and when Cloud Build is the better runner than GitLab. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/gke-autopilot-security-tradeoffs/ https://opensourceom.org/blog/gke-autopilot-security-tradeoffs/ What GKE Autopilot actually locks (nodes, privileged, hostPath) versus what you still own: IAM, images, Workload Identity, and the cases where Standard is the only honest choice. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/how-to-break-cloud-attack-paths/ https://opensourceom.org/blog/how-to-break-cloud-attack-paths/ Break a cloud attack path by cutting the cheapest edge—network, identity, or exposure—then prove the path is gone without a production outage. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/how-to-prioritize-cloud-vulnerabilities/ https://opensourceom.org/blog/how-to-prioritize-cloud-vulnerabilities/ A practitioner guide to cloud vulnerability prioritization beyond CVSS — using exposure, attack paths, and asset context to fix what attackers can actually exploit. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/in-toto-slsa-cloud-builds/ https://opensourceom.org/blog/in-toto-slsa-cloud-builds/ in-toto attestations versus Cosign signatures, GitHub SLSA 2 vs 3, admission verification, and the gaps that still let a signed-but-wrong image run. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/itdr-identity-threat-detection-cloud/ https://opensourceom.org/blog/itdr-identity-threat-detection-cloud/ ITDR cloud identity is runtime detection of stolen roles and tokens—not CIEM hygiene. CloudTrail signals that beat impossible travel, AssumeRole theft patterns, and wiring alerts to blast radius. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/kspm-explained-kubernetes-posture/ https://opensourceom.org/blog/kspm-explained-kubernetes-posture/ KSPM beyond CIS YAML: cluster config versus workload identity, connecting findings to cloud IAM, and where admission control differs from scans. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/kubernetes-image-provenance-slsa/ https://opensourceom.org/blog/kubernetes-image-provenance-slsa/ SLSA levels that actually ship in production Kubernetes: Cosign attestations at admission, why a CVE scan is not provenance, and how to kill :latest. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/kubernetes-pod-to-cloud-admin-path/ https://opensourceom.org/blog/kubernetes-pod-to-cloud-admin-path/ Trace the IRSA and Workload Identity path from a compromised pod to cloud admin, then break that path at the annotation before the cloud role. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/kubernetes-rbac-security-best-practices/ https://opensourceom.org/blog/kubernetes-rbac-security-best-practices/ Production Kubernetes RBAC: namespace Roles not cluster-admin, automount off, bound tokens, aws-auth vs access entries, and kubectl-who-can in CI. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/kubernetes-seccomp-and-apparmor/ https://opensourceom.org/blog/kubernetes-seccomp-and-apparmor/ RuntimeDefault seccomp and AppArmor annotations for Kubernetes: what syscalls they block, why they do not stop API abuse, and when audit mode is lying to you. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/multi-account-aws-attack-paths/ https://opensourceom.org/blog/multi-account-aws-attack-paths/ How AssumeRole, resource policies, and SCPs create org-wide AWS attack paths, including trusts and denies that do not apply where you think. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/opentofu-security-vs-terraform/ https://opensourceom.org/blog/opentofu-security-vs-terraform/ OpenTofu vs Terraform for security: MPL versus BSL, signed providers and lockfiles, state compatibility, and which policy-as-code options survive the fork. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/pulumi-crossguard-policy/ https://opensourceom.org/blog/pulumi-crossguard-policy/ Write Pulumi CrossGuard packs that deny public IPs at preview, how they differ from Gatekeeper, and how to run them in CI without a second OPA tutorial. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/reachable-risk-cloud-security/ https://opensourceom.org/blog/reachable-risk-cloud-security/ Rank cloud findings by reachable risk: network plus identity paths, why private subnets lie, and ticket text that includes the actual attack path. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/security-graph-explained-cloud/ https://opensourceom.org/blog/security-graph-explained-cloud/ The cloud security graph data model: nodes and edges in practice, queries that replace spreadsheet sorts, and what OpenSourceOM will not model. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/self-hosted-cspm-architecture/ https://opensourceom.org/blog/self-hosted-cspm-architecture/ How a self-hosted CSPM is built: collectors and credentials, the graph store, the policy engine, and multi-tenant isolation—not a recap of which scanner to buy. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/shadow-admin-detection-cloud/ https://opensourceom.org/blog/shadow-admin-detection-cloud/ Shadow admins are not in the Admin group. Hunt AWS PassRole, Azure Owner/UAA, and GCP setIamPolicy with effective-permission queries, not role-name filters. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/terraform-state-security-s3-backend/ https://opensourceom.org/blog/terraform-state-security-s3-backend/ Terraform state in S3 is a secret store: encrypt it, Block Public Access, lock it, and treat s3:GetObject on the state key as production credential access. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/trivy-operator-vs-ci-scanning/ https://opensourceom.org/blog/trivy-operator-vs-ci-scanning/ CI image scans miss cluster drift; Trivy Operator misses the build. When the two overlap, how to dedupe CVEs, and when running both is the right call. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/zero-trust-cloud-architecture-guide/ https://opensourceom.org/blog/zero-trust-cloud-architecture-guide/ Validate cloud zero trust against live reachability: identity-aware ingress, default-deny east-west, no VPN-as-trust, and graph queries that show where the design leaks. Thu, 27 Aug 2026 00:00:00 GMT https://opensourceom.org/blog/open-source-cspm-cnapp-tools-2026/ https://opensourceom.org/blog/open-source-cspm-cnapp-tools-2026/ Survey of open source CSPM, self-hosted CNAPP alternatives, and graph-native cloud security tools in 2026 — plus how to evaluate self-hosted options for your team. Mon, 24 Aug 2026 00:00:00 GMT