terraform-aws-secure-baseline

terraform-aws-secure-baseline Terraform Module Registry A terraform module to set up your AWS account with the reasonably secure configuration baseline. Most configurations are based on CIS Amazon Web Services Foundations v1.4.0 and AWS Foundational Security Best Practices v1.0.0. See Benchmark...

sisu

sisu ⚡ Your AWS, as a filesystem. This: grep -l "AdministratorAccess" iam/users//policies.json Instead of this: aws iam list-users --query 'Users.UserName' --output text | \ xargs -I sh -c 'aws iam list-attached-user-policies --user-name --query "AttachedPolicies.PolicyArn" --output text' | \ gre...

AWS-Threat-Simulation-and-Detection

AWS Threat Detection with Stratus Red Team This repository is a documentation of my adventures with Stratus Red Team - a tool for adversary emulation for the cloud. Stratus Red Team is "Atomic Red Team for the cloud, allowing to emulate offensive attack techniques in a granular and self-contained...

CLEANSTART-2026-II22452 Security fix for GHSA-9h8m-3fm2-qjrq applied in: metrics-server-fips 0.8.1-r3, amazon-cloudwatch-agent 1.300065.0-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, istio-fips 1.28.1-r1

GHSA-9h8m-3fm2-qjrq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IK31949 Security fix for GHSA-hfvc-g4fc-pqhx applied in: cosign 2.6.4-r1, metrics-server-fips 0.8.1-r3, amazon-cloudwatch-agent 1.300065.0-r1, trillian-fips 1.7.3-r1, kube-logging-operator 6.4.0-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, trillian 1.7.3-r1, gotenberg 8.30.1-r0, kyverno-fips 1.13.6-r9, jitsucom-bulker 2.10.0-r0

GHSA-hfvc-g4fc-pqhx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KX96717 Security fix for GHSA-8rm2-7qqf-34qm applied in: amazon-cloudwatch-agent 1.300065.0-r1, metrics-server-fips 0.8.1-r2, node-problem-detector 1.35.2-r1, keda-fips 2.19.0-r1, trillian 1.7.3-r1, elastic-beats 8.19.14-r0

GHSA-8rm2-7qqf-34qm affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IY18121 Security fix for GHSA-wg65-39gg-5wfj applied in: amazon-cloudwatch-agent 1.300065.0-r1, metrics-server-fips 0.8.1-r2, keda-fips 2.19.0-r1, trillian 1.7.3-r1, elastic-beats 8.19.14-r0

GHSA-wg65-39gg-5wfj affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MO57700 Security fix for GHSA-fw8g-cg8f-9j28 applied in: amazon-cloudwatch-agent 1.300065.0-r1, metrics-server-fips 0.8.1-r2, trillian-fips 1.7.3-r1, node-problem-detector 1.35.2-r1, keda-fips 2.19.0-r1, trillian 1.7.3-r1, elastic-beats 8.19.14-r0

GHSA-fw8g-cg8f-9j28 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AG54423 Security fix for GHSA-p77j-4mvh-x3m3 applied in: helm-fips 3.20.2-r0, dynamic-localpv-provisioner 4.5.0-r1, argo-workflows 3.6.19-r3, fulcio-fips 1.8.7-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r2, litestream 0.5.14-r1, falco-exporter 0.8.7-r2, k8sgpt-operator 0.2.27-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, node-problem-detector 1.35.2-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, cert-manager 1.19.4-r1

GHSA-p77j-4mvh-x3m3 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZH84525 Security fix for GHSA-cp6g-7hqx-qxhp applied in: amazon-cloudwatch-agent 1.300065.0-r1, grafana-agent-operator 0.44.3-r1, prometheus 3.9.1-r6

GHSA-cp6g-7hqx-qxhp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NM46992 Security fix for GHSA-w8rr-5gcm-pp58 applied in: amazon-cloudwatch-agent 1.300065.0-r1, kube-logging-operator 6.4.0-r1

GHSA-w8rr-5gcm-pp58 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GP93140 Security fix for GHSA-x744-4wpc-v9h2 applied in: amazon-cloudwatch-agent 1.300065.0-r1, melange 0.55.0-r1, promxy 0.0.96-r2, promxy 0.0.96-r3

GHSA-x744-4wpc-v9h2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NG24474 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the amazon-cloudwatch-agent package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

CLEANSTART-2026-ZW98247 Security fix for GHSA-65xw-vw82-r86x applied in: amazon-cloudwatch-agent 1.300065.0-r1

Security vulnerability affects the amazon-cloudwatch-agent package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-NZ14410 Security fix for GHSA-wf45-q9ch-q8gh applied in: amazon-cloudwatch-agent 1.300065.0-r1

Security vulnerability affects the amazon-cloudwatch-agent package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-OH06424 Security fix for GHSA-w67g-5rqw-f597 applied in: etcd 3.5.29-r0, prometheus 3.5.3-r11, prometheus 3.5.3-r12, velero 1.16.2-r15, amazon-cloudwatch-agent 1.300073.0-r0, etcd 3.5.33-r1, etcd 3.5.33-r3

GHSA-w67g-5rqw-f597 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Important: amazon-cloudwatch-agent

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2026-3350)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3350 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2026-4049)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300073.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4049 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific...

Important: amazon-cloudwatch-agent

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...