u/RoseSec_

Asking this question makes me feel dirty. I'll probably shower after clicking the "post" button, but how are you managing the lifecycle of Windows servers in the cloud? For Linux, we generally roll out new AMIs with patches baked in and all of the automation is in the startup script or AMI, but how are teams managing patching Windows servers in the cloud? Do you attach it to a domain and go through the GPO dance?

A few days ago, I was pleasantly surprised to discover that TFLint has a ruleset plugin for writing custom rules in Rego! So far, so good.

I can’t escape IAM user access keys. Every night, I have the same nightmare of asking a Ouija board how I’ll die. My fingers slowly move over the letter “AKIA.” I'm trying to kill them before they kill me, but if can't, you might as well rotate them frequently. In this short tutorial, I’ll show my approach to implementing “poor man’s” secret rotation using Terraform.

Thought I'd share my approach to providing self-service infra and Terraform modules in GitLab! Anyone else doing something similar?

I maintain a tool called Terramaid that converts Terraform's DOT graph output to Mermaid. I was curious if the community would find this useful as a native feature. Large DAGs make for some messy diagrams, but thought it could pair nicely with terraform-docs for smaller root modules.

Curious if anyone is doing self-service AWS accounts, EC2 instances, etc. without control tower? Looking into creating a service catalog to make self-service provisioning easier for teams, but curious how others approach this when managing the resources in IaC

Is anyone generating SBOMs for their IaC repositories? Looking into the best way to accomplish this for compliance and curious if a tool that converts Terraform lockfiles to SPDX would be beneficial?

I just implemented Cloud Custodian across our environment with checks for unused IAM roles and users. What are your favorite use cases for the tool? Looking for cool ideas on how to use the tooling to increase security.