Warren Parad

Making rate limiting in AWS less terrible

APIGW Usage Plans won't get you the per-user rate limiting you need. And using a WAF is an incomplete solution. But rolling your own is of course fraught with the usual challenges.

Actually Fixing AWS S3

A concrete proposal for redesigning AWS S3's Account Regional Namespace to finally separate private bucket configuration from public access, eliminating a class of accidental data exposure.

Securing CI/CD Access to AWS

How to securely grant CI/CD pipelines least-privilege access to AWS accounts using Lambda, OU StackSets, and short-lived credentials — no long-lived secrets.

AWS Auth Caching Strategies

Trade-offs and patterns for caching authentication and authorization decisions in AWS workloads — reducing latency and cost without sacrificing security correctness.

API Gateway Authorizers: Vulnerable By Design

Exposing a critical flaw in AWS API Gateway's Lambda authorizer caching behavior that allows stale JWT decisions to persist — and how to architect around it.

The Risks of User Impersonation

Why allowing admins to impersonate users creates audit gaps, liability exposure, and subtle authorization bugs — and what to build instead.

Migrating CloudFormation to TF

A practical, zero-downtime migration path from AWS CloudFormation to Terraform — including state import strategies and pitfalls to avoid.

Are millions of accounts vulnerable due to Google's OAuth Flaw?

A rebuttal to Truffle Security's viral Google OAuth disclosure — arguing the actual vulnerability is apps trusting email over the immutable `sub` claim, not a Google flaw.

Magic links and Passwordless login

How magic links and passkeys work under the hood, when to use them, and the security gotchas that trip up teams implementing passwordless authentication.

AWS Advanced: The Quota Monitor Review

A deep-dive review of AWS's Quota Monitor solution — its design trade-offs, gaps, and how to extend it to get actionable alerts before hitting service limits.