12 Insecure AWS Default Settings Every Engineer Should Know and Fix

·25 views

AWS default configurations are optimized for ease of use in tutorials, not for production security, leaving real infrastructure silently exposed. A healthcare infrastructure engineer documented twelve common misconfigurations after repeatedly fixing the same overlooked settings across Terraform deployments. Key risks include the absence of persistent CloudTrail logging for S3 data events, RDS instances created without encryption that cannot be encrypted in place after the fact, and unforced SSL on older PostgreSQL engines allowing silent plaintext connections. Load balancers provisioned without an explicit TLS policy default to accepting outdated TLS 1.0 and 1.1 connections, a finding that can stall enterprise security reviews. Each issue can be resolved with a single targeted configuration change, but automated tools like checkov and tfsec often miss these gaps because they result from absent settings rather than incorrect ones.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Comparer deux versions d'un contrat PDF mot à mot avec Python

Un PDF ne conserve pas d'historique des modifications, ce qui oblige à comparer directement les deux fichiers pour repérer les changements. L'article examine trois méthodes : comparaison des pages rendues pixel par pixel, comparaison du texte extrait ligne par ligne, et comparaison mot par mot. Sur une paire de contrats de test, le diff mot par mot identifie les mêmes cinq modifications même lorsque le texte est recomposé avec une autre mise en page, contrairement aux deux autres méthodes. L'auteur présente un script Python d'environ 120 lignes utilisant PyMuPDF et difflib, qui récupère les coordonnées de chaque mot modifié et réécrit les changements sous forme de commentaires dans le PDF. Il indique aussi qu'un logiciel de bureau, PDF Editor d'osFoundry, applique la même logique de comparaison mot par mot.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Senior Craft Depends on Context and Process, Not Just Code Output

An essay argues that the 'vibe coding' approach of prompting AI for finished code fails because it demands results without first establishing identity and context. The author frames a Be, Do, Have sequence that maps onto Context, Process, and Content, arguing that results depend on the upstream layers. Typical vibe-coding prompts, such as requests to build a login page or fix a race condition, are described as jumping straight to the final output. The piece contrasts this with a structured workflow in which the agent's role and phase-bound constraints are defined before any code is written. It concludes that clean, verifiable output emerges naturally only when the upstream context and process are locked in place.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ten Claude Skills a Freelancer Actually Uses Weekly for Client Work

A freelancer and consultant who has tested Claude skills over a year argues that most skill folders go unused and proposes a rule: only build a skill for a task done at least twice a week. The author identifies three common failures: overly broad descriptions, missing business context, and building for imagined tasks. They recommend first creating a shared context file covering the user's offer, clients, proof, goals, and preferred tone. The article then lists ten skills that survived this filter, including a client brief builder, proposal generator, and scope creep checker, with a summary table of inputs and outputs. A copyable SKILL.md template and a paid resource pack are also offered.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PostgreSQL's SET SESSION AUTHORIZATION alters both session and current user identities

PostgreSQL tracks two identities per session: the authenticated session user and the current user used for permission checks. SET SESSION AUTHORIZATION can change both, which is useful for controlled administrative tasks but risky in pooled or diagnostic contexts. Only superuser sessions may switch the session user to an arbitrary name, while other sessions are limited to their own authenticated name, and DEFAULT or RESET restore the original identity. The command cannot run inside a SECURITY DEFINER function and affects which roles later SET ROLE commands can assume, so reviews checking only current_user may miss it. The guidance recommends separate database roles, resetting session state before connection reuse, and verifying session_user, current_user, and current_setting('role') in tests.

0 comments Read more at DEV Community