Hack the OWASP Juice Shop Application and Protect It with AWS WAF (Part 1)
This is the first post in this series about the penetration test of the vulnerable web application, OWASP Juice Shop, and how we can utilize AWS WAF to protect against some hacking techniques. Problem statement Nowadays, most software products have web applications, and developing a secure application is challenging. There are many ways to hack […]
Centralizing Health Event Reporting for AWS Organizations at Scale
AWS Health provides ongoing visibility into your resource performance and the availability of your AWS services and accounts. You can use AWS Health events to learn how service and resource changes might affect your applications running on AWS. AWS Health provides relevant and timely information to help you manage events in progress. It also helps […]
Capabilities and limitations of Palo Alto Firewall in AWS
In the previous post, we looked at how we can analyze and filter egress traffic via the dedicated central appliance (Palo Alto Firewall). A set of Firewall VMs was deployed behind the AWS Gateway Load Balancer. The Palo Alto Firewall was intended to solve many different problems for the organization. In the process of the […]
Control Tower Guardrails overview (Preventive, Detective and Proactive)
A Guardrail (or Control) is a high-level rule that provides ongoing governance for your overall AWS environment. It’s expressed in plain language. AWS Control Tower implements preventive, detective, and proactive controls that help you govern your resources and monitor compliance across groups of AWS accounts. A control applies to an entire organizational unit (OU), and […]
GitOps for AWS Cloudformation
What is GitOps GitOps is an operational framework that uses DevOps best practices for application development, such as version control, collaboration, compliance, and CI/CD, and applies them to infrastructure automation. In the GitOps approach, we use a Git repository as the single source of truth for infrastructure definitions. Git is an open-source version control system […]
Moving to AWS Graviton. Why and How?
AWS continuously improves cloud services and introduces new hardware for processing power, but customers usually do not rush to move to newer instance generations. AWS documents state that newer generations are more powerful and cheaper, but what is the difference in numbers? In this post, I researched and compared four generations of the instance type […]
Implementing “for each” logic in the CloudFormation template for dynamic input parameters.
Problem statement In some cases, CloudFormation’s capabilities may be limited compared with those of other IaC tools, such as Terraform, CDK, Pulumi, etc. For example, in the previous post, we looked at implementing a “sleep” timeout using the Custom CloudFormation resource. Here, we look at the case where we must create a Route 53 Resolver […]
Using AWS IAM Identity Center for SSO to access shared services (OpenVPN, OpenSearch, Grafana, ArgoCD)
Automat-it, as an AWS Well-Architected Partner, gains expertise in building high-quality solutions, implementing best practices, checking the state of workloads, and making improvements to fit business and customer needs. Security Pillar is the most popular for our reviews, and one of the first questions we ask is, “How do you manage identities and permissions for […]
Cloud Intelligence Dashboards Framework for AWS Organization
According to the Shared Responsibility Model AWS is responsible for “Management of the Cloud”, while a customer is responsible for Security and Operations in the Cloud + attention to costs as AWS provides virtually unlimited capacity on the “pay as you go” model. There are native AWS tools like AWS Trusted Advisor, AWS Cost Explorer, […]
Simulating failures in Amazon Aurora MySQL / PostgreSQL
Clouds allow us to design highly-available and fault-tolerant systems quite easily. Moreover, we can use managed services (for example, databases) to reduce the operational overhead and focus on our business logic. Design and implementation are not enough; we should also test how our system tolerates failures and continuously improves. In this post, we will look […]