On June 3rd, a policy called FinOpsAgentOperatorPolicy appeared in the AWS managed policy archive carrying 31 actions under a service prefix nobody had ever seen before: finops-agent. AWS announced the public preview of AWS FinOps Agent on June 9th.
Back in 2019, I started MAMIP, then → IAMTrail to answer one nagging question: what exactly changed in an AWS-managed IAM policy, and when?
Since my last post on clickops-notifier, I’ve renamed it to clickops-sentinel, which I found more appropriate, and updated the code to support richer emails (with session path).
I don't know where this is going, but this weekend I decided to put my generous Claude Fable access (until July 7th) to work on something that has been on my mind for months. The idea: bring visibility to manual actions made by humans on your AWS account, and supercharge those alerts with AI.
I have been automating my home for close to 10 years. It started with Jeedom in 2017, then, three years ago, I moved everything to Home Assistant (HA). House got smarter, but the config got heavier: YAML, templates, integrations, and a long list of small rules to remember.
14 months ago: first commit of Trustline. A 200-line script that scanned IAM role trust policies and S3 bucket policies, matched every external account ID against the fwd:cloudsec known-vendors dataset, and printed who actually had access to my AWS account.
A real customer incident taught me this the hard way: Databricks workloads chewed through a subnet's IP addresses so fast that we ran out of free IPs and new resources simply stopped launching. The frustrating part? AWS gives you no free, built-in gauge to see it coming.
AWS Security Survival Kit (ASSK) is one of my free and open-source projects that turns your CloudTrail noise into a small set of actionable alerts. Two CloudFormation stacks, a handful of EventBridge rules, and an SNS topic.
Pretty soon, the smart answers will all come in the first week of the month. By the 28th, everyone's overdrawn, like your bank account, but for tokens.
I've used Cursor for years as my main AI code editor. Familiar VSCode interface, solid autocomplete, and enough AI help without losing control. Just tested the new 3.0 version. First reaction: skeptical. A brand-new agent-centric app felt like a step backward. Less control, more abstraction.
What shipped on unusd → March & April '26 - 13 new finding types: Lambda Optimizer, EBS Idle, EBS io1 → gp3, EBS Snapshot Archive, EFS, Idle ElastiCache, ElastiCache Valkey, DocumentDB, DynamoDB, Kinesis, Step Functions, RDS Storage, CloudFront
New week, new feature on IAMTrail. IAM action context is now built into managed policy views. For each action, you get useful metadata: description, access level, and where it appears. Data comes from iam-dataset by Ian McKay.
Yesterday, AWS inadvertently pushed a test IAM managed policy to production. It was detected by IAMTrail, and this is one of the reason of buiding this tool.
IAMTrail was taking 46 minutes to scan 1,500 AWS managed policies. The culprit: spawning 1,500 separate AWS CLI processes. Each one boots Python, loads boto3, makes one HTTP call, then exits.
Did you know that AWS publishes SNS notifications when changes occur on Amazon GuardDuty? I've been monitoring and archiving this for 4+ years, and it's now available on IAMTrail.
Lately, I've realized that I've been working in the AWS space for nearly 10 years.
IAMTrail now tracks AWS endpoint changes, sourced directly from the Official botocore AWS repository. It reveals service expansions, new region launches, and new partitions - often before they're officially announced.
Since 2019, I've been tracking every AWS Managed Policy change in a Git repository (MAMIP). In the last few months, I've added: - A Landing Page with search capabilities, stats - Known Account Lookup based on the fwdcloudsec dataset - Results of IAM Access Analyzer on these AWS Policies
Just added a new section to the MAMIP webapp to review findings from AWS IAM Access Analyzer on ALL AWS Managed Policies. These capabilities can sometimes yield interesting results and may even spoil upcoming AWS capabilities, etc.
Just added a new feature to MAMIP. You can now search for known AWS accounts from the fwdcloudsec dataset. Single webapp to look up AWS managed policy history, search known AWS account IDs, and more. Give it a try.
A few days ago, I found the very first commit of unusd.cloud. Back then it was called Instance-Watcher. The whole logic fit in one screenshot. A simple Python function using boto3 to send a daily HTML table of running EC2 instances across all AWS regions.
Coding in 2026 is like: - Playing Starcraft with "Show me the money". - \devmap q3tourney2 + \god in Q3. - DNKROZ in Duke Nukem. - IDDQD for Doom. Your turn.
Lately, we've added many new features to unusd, thanks to customers' feedback. 1. Navi - Our AI assistant to better understand your cloud spend. 2. Management Reports - C-Level reports (Org Wide). 3. Support of Savings Plans and RIs. 4. Drift Detection with advanced Algorithms.
I knew about WireGuard, but what is Mimic (Avast)? Mimic - Disguises VPN traffic to look like normal web browsing - Designed to bypass firewalls and censorship systems - Slower performance due to traffic disguising techniques - Better for accessing blocked social media in restrictive countries
December is generally a good time for gifts, and I have a special one for you. We are glad to announce fwd:cloudsec Europe 2026: September 7th and 8th - London, UK 🇬🇧 More info to come early 2026. Stay tuned, folks.
Just shipped a compagnon website for MAMIP, the tool that detects change made by AWS on IAM Managed Policy. Let me know what do you think of this first version. I'm considering adding many new features in the next upcoming weeks.
Just 2 hours to go before fwd:cloudsec Europe kicks off here in Berlin! 🇩🇪 We’ve got an incredible lineup of speakers this year covering the latest in cloud security, from IAM and supply chain risks to practical defense strategies.
Since January, I've resumed running. It's part of my New Year's resolution: new gear and a more challenging routine after a seven-year pause and passing the 40-year milestone. I'm now using Strava only to record my activities, and I've found a few cool FOSS initiatives that are game changers.
