Tag See all →

#cloud-security

2 stories

Banner: an IAM policy with Allow and NotAction quietly granted IAM admin, reading what a policy really allows

Cloud & Infrastructure Bug Report

An IAM policy with Allow and NotAction quietly granted IAM admin: reading what policies really allow

Grace Liu · Jun 3, 2026 · 8 min read

A developer role was meant to allow everything except IAM changes. Its policy used Allow with NotAction, yet a review found it could create access keys for other users and assume an admin role. How we found it with the policy simulator and Access Analyzer, and rewrote it safely.

Cloud & Infrastructure Bug Report

Customer exports found in a public S3 bucket: what shared responsibility really means

Samuel Osei · Apr 2, 2026 · 8 min read

A researcher reported that CSV exports with customer emails were downloadable from an S3 bucket. The cause was a bucket policy granting public read, added years earlier for a static site. How we contained it, proved who accessed what, and locked down every bucket.