security

EBS default encryption per Region, CMK lifecycle, block public snapshots. July 2026 baseline checklist — retrofit is expensive.

Hardening quick wins: private DMS, OpenSearch encryption, SageMaker VPC-only, Lambda runtime EOL. July 2026 checklist.

DORA on AWS since Jan 2025: RoI, TLPT/TIBER-EU, incident clocks, Artifact addendum. July 2026 readiness checklist.

How to build a vulnerability management program that scales beyond CVE-counting. Inspector v2 deployment, CVSS + CISA KEV + reachability for risk-based prioritization, container and IaC scanning in CI/CD, and remediation SLAs that survive audits.

GDPR compliance on AWS for SaaS companies handling EU resident data. Region selection, the AWS DPA, data subject rights automation, RoPA documentation, breach notification, and the technical controls regulators expect.

ISO 27001:2022 on AWS: ISMS scope, 93 Annex A mapping, Stage 1/2 evidence. July 2026 stage checklist.

NIS2 on AWS: Essential/Important scope, Art. 21 measures, 24h/72h clocks, supply chain. July 2026 checklist.

NIST CSF 2.0 on AWS: Govern + six functions, tiers, 800-53/171/CMMC. July 2026 Tier-3 checklist.

AWS CLI v2 #10196 chmod'd streaming outputs to 0600 — including /dev/null. July 2026 retrospective: #10215 revert, host repair, pin-and-canary checklist.

Most AWS security breaches aren't caused by AWS failures — they're caused by misconfiguration. Here are 10 concrete best practices to harden your AWS environment in 2026.

Real AWS DevOps practices from production: GitOps on EKS, OpenTelemetry, supply chain security, chaos engineering with FIS, and AI-assisted DevOps with Amazon Q.

SOC 2 Type II certification proves your controls are effective over 6-12 months. This guide covers the compliance roadmap, AWS security controls, documentation requirements, and audit preparation for 2026 certification.