Developer builds IAM policy linter, finds security gaps in Prowler's 48 checks

·1 views

A software developer built an open-source CLI tool called iam-lint while preparing for a cloud security engineering interview, which scans AWS IAM policy documents for critical misconfigurations. The tool implements seven rules covering risks such as wildcard actions, unrestricted admin access, privilege escalation paths, and missing MFA conditions. After completing the tool, the developer systematically reviewed all 48 of Prowler's existing IAM checks to avoid duplicating already-solved problems. The comparison revealed that while some rules overlapped with Prowler's coverage, at least one non-trivial security gap was identified that Prowler does not currently address. The tool integrates directly into CI pipelines via exit codes and supports JSON output for machine-readable results.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Browser-Based PDF Toolkit Processes Files Locally Using WebAssembly

DeskRamp is a Chrome extension that performs PDF operations such as merging, splitting, compressing, and converting entirely within the browser, without uploading files to a server. The tool is built on WebAssembly-compiled PDF libraries, which are now fast enough to run client-side and handle most tasks almost instantly. Developers had to navigate key technical hurdles, including adding an explicit 'wasm-unsafe-eval' exception to Chrome's Manifest V3 Content Security Policy and lazy-loading multiple specialized libraries to keep install size manageable. The biggest runtime constraint proved to be browser tab memory rather than processing speed, requiring chunk-based processing and careful manual release of memory references for large documents. The privacy benefit is the core motivation: sensitive files like contracts and financial documents never leave the user's device.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

npm Version Drift and Outdated Node.js Silently Broke LINE Bot Feature for Three Days

A developer discovered that a URL-summarization feature in their LINE chatbot had been silently failing for three days due to an unlocked npm package version in the Docker image. The single-file-cli package quietly upgraded to a version requiring Node.js 22.4 or later, while the container was still running Node 18. All three fallback methods for fetching webpage content failed, but the bot only surfaced a generic error to users with no indication of the root cause. The debugging process revealed that a successful npm build does not guarantee runtime functionality, since npm treats engine version mismatches as warnings rather than build failures. The developer resolved the issue through multiple Dockerfile rebuild cycles, each followed by live runtime testing rather than relying solely on build logs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a cp932 Encoding Bug Crashed Builds on Japanese Windows but Not on Mac

A character encoding mismatch between UTF-8 and cp932 caused a build pipeline to crash on Japanese-locale Windows machines while working perfectly on macOS. The issue arose because Python defaults to the platform's locale encoding when capturing subprocess output, meaning emoji-containing strings that pass freely under UTF-8 trigger a UnicodeEncodeError under cp932. In this case, a build script shelled out to a version-checking tool whose success message included emoji, which cp932 cannot encode, causing the subprocess to crash. The build script then misreported the failure as a version-consistency error, obscuring the root cause and wasting debugging time. To prevent recurrence, a dedicated test file was created to statically check scripts for cp932-unsafe characters on macOS before code reaches Windows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build Your First GitLab CI/CD Pipeline Using Python and FastAPI

A tutorial series on DEV Community introduces developers to GitLab CI/CD as an alternative to GitHub Actions for automating software workflows. GitLab is highlighted as an all-in-one platform combining Git repositories, CI/CD pipelines, container registry, security scanning, and observability tools. The series begins with a beginner-friendly pipeline setup using a FastAPI Python project hosted on GitLab.com. The first installment focuses on building a simple automated test pipeline from scratch, with plans to progressively advance toward a professional-grade setup. The guide targets developers already familiar with GitHub who want to explore GitLab's broader DevOps capabilities.

0 comments Read more at DEV Community