Amazon CodeWhisperer is an AI code service that provides real-time code suggestions in your Integrated Development Environment (IDE) to help you quickly write your code. On April 13th, Amazon CodeWhisperer is generally available. There are two tiers, Individual and Professional. For the Individual tier, it’s free to use 🧐, and…

Server-side request forgery (SSRF) attack is used for abusing functionality on the server to read or update internal resources. The main idea behind an SSRF attack is to manipulate the input parameters of an application that interact with external systems, such as URLs, IP addresses, or file paths. By injecting…

Every day millions of lines of code are written. Every day, millions of developers spend hours identifying problematic code to help improve their code quality and reduce application performance issues. Sometimes identification of these issues is hard to find and time-consuming. We need some tools to automate these processes. In…

We’ve encountered security headers findings in our vulnerability scans & security reports. Today, I will mention how to remediate these findings related to AWS resources in an easy way. Note: Please make sure these configurations don’t break any functionalities such as JavaScript files that are rendering successfully. Sometimes these headers…

I recently passed the AWS Security Specialty exam and want to share my experiences, study resources, and process with you. I hope these tips will help you to pass your exam. Let’s start together! This cool exam takes 170 minutes. It costs 300 USD. …

IP whitelisting with your VPN address is one of the most important solutions for critical admin pages/panels, internal, testing or development applications. We do not want our admin panels open to the world. We do not want our testing platform publicly accessible. These scenarios can increase attack surfaces for your…

Let’s assume our worst nightmare occurred: One of the most important production environments that are built on AWS EC2 services was hacked. What are the required steps for returning to your normal application behavior? What needs to be done for your forensic analysis? What steps should be done to not…

Cloud security monitoring and increasing visibility are two main important things in the cloud. It helps us to build automated solutions for identifying risky or malicious behavior in the cloud environment. It is also required for every major regulation such as HIPAA, PCI DSS, etc. Every day there are lots…

AWS re:Invent 2022 is completed in Las Vegas. I did not attend in person, but I’ve watched some security sessions and announcements online and I want to share my notes with you. I hope you will enjoy it! Let’s start! 🤔 1- Amazon Security Lake: As you know, security data…