← All writing
Cloud Security·Apr 09, 2026·9 min read
Cloud Pentesting: IAM Is the Whole Ballgame
Across AWS, GCP, and Azure, the same pattern keeps showing up — the breach isn't a clever exploit, it's an over-permissioned role nobody audited.
I've spent a lot of time securing and testing cloud infrastructure across AWS, GCP, and Azure. The vulnerabilities that actually matter are rarely exotic. They're misconfigurations — and more often than not, they live in IAM.
Hardening configurations and enforcing least-privilege isn't glamorous, but it's where blast radius is won or lost.
Next up →