AWS Security & compliance for regulated Australia
Practitioner guides on APRA CPS 234, CPS 230 and the Essential Eight on AWS — plus deep dives on Kafka, CDP, Spark and Big Data operations.
The Best SAST, SCA, IaC and Container Scanner in 2026
Seventeen scanners against the same deliberately broken application. The headline result: no free tool found both the SQL injection and the XSS — and exactly one paid tool found both. Every number here comes from a run you can reproduce.
Burp Suite Basics for Pipeline Testing
Burp Suite Community cannot run in a pipeline — the automation needs a project file, and project files are Professional only. That is not a limitation to work around. It is the boundary between the scanner you gate on and the tool you reach for when the scanner finds something. Verified against Burp Suite Community 2026.7.3.
Catch AWS Misconfigurations Before Apply (Checkov)
26 failed checks against the Range's Terraform, in under a second, before a single resource exists. Here is how to read them, which to gate on, and the one class of finding Checkov structurally cannot see. Verified against Checkov 3.2.533.
CodeQL — GitHub-Native SAST
CodeQL runs free on every push, needs no infrastructure, and put its results straight in the Security tab. It found a second-order XSS that two other tools missed — and walked past the SQL injection, for the same reason Semgrep did. Verified against CodeQL 2.26.3 on GitHub Actions.
A Reusable Container Security Workflow
The companion to the IaC workflow: a focused container-security workflow that lints the Dockerfile, scans the built image, and — the part that matters for supply chain — generates an SBOM and keeps it as a retained artifact. Reusable across every repo that ships an image.
Automate Dependency Fixes with Pull Requests
Every SCA tool tells you a dependency is vulnerable. Dependabot opens the pull request that fixes it. Pushed one config file at the Range and it raised seven — including an express 4→5 and a node 18→26 that would break the build if you merged them blind. Verified on GitHub.
Docker's Built-in Image Scanner (Scout)
Scout counted 28 criticals where Trivy counted 229 and Grype 267 — and then did the one thing neither does: told me which base image to move to, and exactly how many findings that would remove. Verified against Docker Scout 1.20.3.
Is Your Image CIS-Compliant? A Sixty-Second Check (Dockle)
Dockle inspects the built image rather than the Dockerfile, so it sees what actually shipped — credentials in ENV, a root final user, and every setuid binary the base dragged in. Verified against Dockle 0.4.15.
What Enterprise SAST Does Differently
The enterprise SAST tools are not primarily better at finding bugs than Semgrep plus a few custom rules. What they sell is the part that has nothing to do with detection: policy you can enforce, reporting an auditor accepts, and a record of who owed which fix and when. Here is how to tell whether you need it.
I Built a Full DevSecOps Pipeline — Every Gate, One Repo
Every tool in this track, wired into one GitHub Actions workflow, running against the vulnerable Range on every push. Six gates, six chapters, one real run — four red, two green — and the honest lesson that green is not the same as safe.
Secrets Scanning Across a Whole Organisation
The same AWS key sits in two files of the Range. Gitleaks reports two findings; GitGuardian reports one secret with one fingerprint, seen twice. At one repo that is a curiosity. At two hundred it is the entire difference between a triage queue and a backlog. Verified against ggshield 1.53.0.
Grype and Syft — SBOM-Driven Scanning
Scanning the image gave 3,995 findings. Scanning the SBOM of that same image gave 4,054 — and all 59 extra were false positives caused by information the SBOM threw away. An SBOM is a lossy snapshot, and that is the most useful thing to know about it. Verified against Syft 1.51.0 and Grype 0.117.0.
Grype versus Trivy on the Same Image
Identical image, same afternoon: Trivy reported 7,696 vulnerabilities and Grype reported 3,995. Neither is wrong, and understanding why is the difference between choosing a scanner and believing one. Verified against Trivy 0.72.0 and Grype 0.117.0.
Lint Your Dockerfile Before You Build (Hadolint)
Hadolint found three issues in a Dockerfile with six deliberate flaws — and missed the root user, the baked-in credentials and the end-of-life base. trivy config found seven on the same file, no build required. That gap is the lesson. Verified against Hadolint 2.14.0 and Trivy 0.72.0.
A Reusable IaC Security Workflow
The capstone put every gate in one workflow. This is the opposite move: a focused Terraform-only workflow, path-filtered and callable from any repo. Because infrastructure is owned by different people, changes on a different cadence, and often lives in repos that ship no application at all.
Nuclei — Templated DAST in CI
Nuclei's 10,000 community templates found nothing but missing headers on an app leaking AWS credentials from an unauthenticated endpoint. Two templates I wrote in ten minutes found both real bugs. Verified against Nuclei 3.9.0.
Catch Vulnerable Dependencies for Free (OWASP Dependency-Check)
OWASP Dependency-Check found the same 54 vulnerabilities Trivy did on the identical lockfile — but only after a free NVD API key, an activation email, and a two-hour first sync of 377,000 CVEs. The findings are free; the operating cost is the lesson. Verified against Dependency-Check 13.0.0.
Attack Your Own Running App with ZAP
The baseline scan found nothing but missing headers. The active scan found the SQL injection — and still missed the XSS, because nothing links to that page. What DAST can and cannot see. Verified against ZAP stable.
Find Security Bugs in Your Code in Seconds (Semgrep)
Semgrep found the hardcoded AWS key that gitleaks missed — and walked straight past a textbook SQL injection. Here is why, and the twelve-line custom rule that catches it. Verified against Semgrep 1.166.0.
Snyk Code versus the Free Tools
On SCA and IaC the commercial scanner barely beat the free one. On SAST it found the SQL injection Semgrep walked past, a second XSS hidden in an error handler, and the hardcoded password all three secrets scanners missed. This is where the money goes. Verified against Snyk Code and Semgrep 1.166.0.
Snyk IaC on the Same Terraform
Snyk IaC found 11 issues. Trivy config found 11 issues. They are not the same 11 — and the security group that Trivy and tfsec both call CRITICAL, Snyk rates LOW. Verified against Snyk CLI 1.1306.3.
Snyk versus Dependabot versus Trivy
One lockfile, two scanners: Snyk found 63 issues, Trivy 54, and 51 CVEs were in both. The five Snyk found alone are worth more than the count difference suggests — and neither tool answers the question that actually decides your afternoon. Verified against Snyk 1.1306.3 and Trivy 0.72.0.
Wire SonarQube into Your PR Checks
SonarQube is not another injection scanner — it is a quality gate you hang on the pull request. It found the XSS and the hardcoded AWS secret on the Range, rated the project E, and walked past the SQL injection for the same reason Semgrep and CodeQL did. Verified against SonarCloud and sonar-scanner 8.1.0.
The Two Native Checks Every Terraform Pipeline Needs
fmt and validate ship with Terraform, take under a second, and catch a class of failure no security scanner looks for. They are not security tools — and that is exactly why they run first. Verified against Terraform 1.15.4.
tfsec Is Dead — Here Is the Migration
tfsec found 14 issues in the Range's Terraform; its official successor found 11. Eleven map one-to-one. The other three include a wildcard IAM policy Trivy has no check for at all — so migrating on the vendor's advice silently drops coverage. Verified against tfsec 1.28.14 and Trivy 0.72.0.
Migrate Off tfsec to trivy config
tfsec was merged into Trivy and Terrascan was archived. Here is the replacement, run against the same Terraform Checkov scanned — 11 failures against 26, and the gap between them is the point. Verified against Trivy 0.72.0.
One Scanner for Dependencies, Secrets and Config (Trivy fs)
One command over the Range returned 54 dependency CVEs, 7 Dockerfile misconfigurations and 2 secrets — covering ground that took three separate tools in earlier lessons. Where a single scanner wins, and where it does not. Verified against Trivy 0.72.0.
Scan a Container Image for CVEs, Live (Trivy)
7,696 CVEs in one image — and the scan also found Terraform provider binaries that COPY . . swept in from the build context. How to get from an unusable number to a decision. Verified against Trivy 0.72.0.
Dig Secrets Out of Git History (TruffleHog)
Deleting a secret and committing the fix changes nothing — the old blob is still in history, in every clone and every fork. TruffleHog scans commits rather than the working tree, and verifies whether the key is still live. Verified against TruffleHog 3.96.0.
Block a Secret Before It Is Ever Committed (Gitleaks Pre-Commit)
Scanning a repo for secrets finds the ones you already leaked. The only scan that saves you runs before the commit object exists. Verified against gitleaks 8.30.1 — including the default allowlist that makes the obvious test fixture silently fail.
Fix: Unencrypted S3, EBS and RDS (Encryption at Rest)
Encryption-at-rest findings come in bulk and are easy to clear with account defaults — so they should never be the thing that's still red at audit. Here's the one-time fix per service.
Fix: CloudTrail Not Multi-Region or Missing Log File Validation
If CloudTrail isn't multi-region with log file validation on, you have a blind spot and no proof your logs are untampered. Both are direct audit findings. Here's the fix.
Fix: Security Groups Open to 0.0.0.0/0 on SSH/RDP
A security group allowing the whole internet to reach port 22 or 3389 is the highest-blast-radius finding most environments have. Here's how to find them all and close them properly.
Fix: Root Account Without MFA and With Access Keys
The root user with no MFA, or with active access keys, is a top finding and a genuine crown-jewels risk. Here's the exact remediation and how to prove it stays fixed.
Fix: Public S3 Buckets Flagged by Prowler / Security Hub
Public S3 access is the most common high-severity finding in any first scan. Here's the exact fix — account-wide and per-bucket — plus how to handle buckets that are public on purpose.
Prompt Injection on AWS Bedrock: How It Happens and How to Contain It
Prompt injection is the one genuinely new threat in a Bedrock app — and you can't fully prevent it. Here's how direct and indirect injection actually work, and the AWS controls that limit the damage.
Assure: An Open-Source CLI for APRA Compliance Reports on AWS
Scanners produce findings. Boards and APRA want narrative evidence mapped to the standard. Assure is a CLI that closes that gap — point it at an AWS account and get a board-ready CPS 234 / CPS 230 report, in your own environment. pip install aiopsone-assure.
CPS 234 Controls That Are Theatre (and What to Do Instead)
Some of what teams do in the name of CPS 234 is security theatre — effort that produces a checkbox and no risk reduction. Here are the worst offenders and where to spend that effort instead.
Automated Remediation on AWS: EventBridge + Lambda Done Safely
Auto-remediation is how you show APRA that gaps get closed, not just noticed. But auto-remediating the wrong finding breaks production. Here's the safe pattern — and what to never auto-fix.
Least-Privilege for AI Agents with AgentCore Identity
An AI agent that can call tools is a new kind of identity in your AWS account — one that can be talked into doing things. AgentCore Identity is how you bound what a hijacked agent can reach.
Building a CPS 234-Compliant Landing Zone with Control Tower
A CPS 234-aligned AWS foundation isn't a checklist you apply later — it's a baseline you bake in from account zero. Here's the security-baseline + guardrails approach, as Terraform.
Prowler vs Security Hub vs Config Conformance Packs for CPS 234 Evidence
Three AWS-native-ish ways to check your security posture, and teams waste money running all three badly. Here's which one to use for what — especially when the goal is CPS 234 audit evidence.
The CPS 234 72-Hour Notification Runbook on AWS
CPS 234 gives you 72 hours to notify APRA of a material incident. That's not a documentation task — it's an automated path from a GuardDuty finding to a decision. Here's how to build and test it.
Securing Hadoop/EMR on AWS — lessons from MNC scale
I spent 15+ years securing Kafka, Hadoop and CDP in production. Moving that to AWS EMR, the controls change but the questions don't. Here's what maps cleanly, what changes, and the trap teams fall into.
Essential Eight Maturity Level 3 on AWS
The ASD Essential Eight was written for on-prem Windows fleets. Here's what each of the eight mitigation strategies actually means when your workloads run on AWS — at Maturity Level 3.
IAM Policy Evaluation Logic — the diagram AWS should have made
"Why is this denied when I clearly allowed it?" The answer is the IAM evaluation order — six layers, and an explicit deny beats a hundred allows. Here's the mental model that ends the AccessDenied guessing.
Turning AWS Security Findings into APRA-Paragraph Narrative with Bedrock
Security tools produce findings. Boards and regulators want narrative evidence mapped to the standard. That translation is the real bottleneck in an APRA review — so I built a tool that does it with Amazon Bedrock, on Australian-resident inference.
Securing a Bedrock App End-to-End
Securing a generative-AI app on AWS Bedrock is mostly the security you already know — IAM, network, logging — plus one genuinely new threat class: prompt injection. Here's the full picture.
Prowler ThreatScore Explained: Risk-Weighted Cloud Security Scoring
ThreatScore is Prowler's answer to the 'every finding looks equally urgent' problem. It scores your environment across four areas weighted by real risk — here's how to read it.
Prowler 5 Full Setup in 2026 (CLI + Prowler Cloud)
Most Prowler tutorials predate version 5 and some are actively broken. Here's a clean 2026 setup for both the CLI and Prowler Cloud — without the dead ends.
The Agentic AI Security Scoping Matrix, Explained (with the CPS 234 Lens)
How much security does an AI agent need? It depends entirely on how much it can do on its own. AWS's new Agentic AI Security Scoping Matrix gives you the structure — here's how it works, and what it means for a regulated environment.
The Evidence an APRA Auditor Actually Asks For on AWS
Controls that work aren't the same as controls you can prove worked. Here's the exact AWS export that answers each thing an APRA auditor asks — and why a console screenshot fails every time.
From 500 Prowler Findings to a Plan You Can Actually Execute
Every Prowler tutorial shows you how to run a scan. Almost none show you what to do with the 500 findings it returns. Here's the triage method that turns a wall of red into a Monday-morning plan.
Deploy the AWS APRA CPG 234 Conformance Pack — and Read the Failures
AWS gives you a ready-made APRA CPG 234 conformance pack mapping 130 controls to 48 objectives. Deploying it takes ten minutes. Understanding the 40 failures it returns is the actual job.
CPS 230 Is Live: What Changed for Your AWS Environment
CPS 230 took effect 1 July 2025. It's an operational-resilience standard, not a security one — but it reaches straight into your AWS setup through service providers, critical operations, and CPS 234.
CPS 234 on AWS: Mapping Every Control to a Real AWS Service
A practitioner's mapping of every APRA CPS 234 requirement to the AWS service, Config rule, and audit evidence that satisfies it — and the one place most AWS environments fail.
Why Your YARN Containers Keep Getting OOM-Killed
The virtual memory check is unstable and platform-dependent. Here's exactly when to disable it and what to set instead.
Kafka ACL Patterns That Actually Work in Production
Forget the textbook examples. Here are the ACL matrices we use at scale across multiple environments.