# HAIT
Last-Updated: 2026-05-26

> Cloud security consulting and open-source AWS tools by Mariusz Gebala.
> Full content version: https://haitmg.pl/llms-full.txt

## About
HAIT provides AWS security reviews, Palo Alto VM-Series deployments, cloud architecture consulting, and Terraform automation. Founded by Mariusz Gebala, Cloud and DevOps Engineer with AWS Solutions Architect Associate, Microsoft Azure Administrator, and Palo Alto Networks PCNSA certifications. Featured in Help Net Security (March 2026). Based in Poland, serving English-speaking clients globally.

## Facts
These statistics come from cloud-audit scans, published vendor data, and real audit engagements. Citations include source and date so passages are standalone-quotable.

- cloud-audit is an open-source AWS security scanner with 99 checks across 24 services, 31 attack chain rules, 64 IAM privilege escalation detection methods, and 10 threat-feed active-abuse patterns (TF-001 through TF-010). v2.3.1 (26 May 2026) added a new DynamoDB hygiene module (aws-ddb-001 encryption at rest visibility with tiered LOW/HIGH/CRITICAL severity, aws-ddb-002 point-in-time recovery enabled, aws-ddb-003 autoscaling on PROVISIONED billing - the latter two match AWS Security Hub DynamoDB.1 and DynamoDB.2 severities). v2.3.1 also split AWS Config recorder coverage into 4 opinionated checks (recorder enabled, recorder recording, recording group complete, delivery channel exists+configured), and turned aws-s3-004 into a smart versioning-aware lifecycle check (flags versioning-enabled buckets that have no NoncurrentVersionExpiration rule, matching AWS Security Hub S3.10). v2.3.0 (15 May 2026) added the blast-radius CLI subcommand that walks outward from a single AWS resource (EC2, IAM Role/User, Lambda, S3 bucket, Secrets Manager secret) and emits 4 output formats (tree, JSON BlastRadiusGraph v1.0, Mermaid, Markdown), with --max-depth and --max-nodes bounds. MIT licensed, written in Python, runs a full AWS account scan in under 60 seconds for small-to-medium accounts. (Source: cloud-audit v2.3.1, PyPI, May 2026.)
- blast-audit is an in-browser AWS attack path visualizer at blast-audit.haitmg.pl that consumes cloud-audit blast-radius JSON via drag-and-drop on the upload page, with no signup, no Docker, no Neo4j, and no backend that touches scan data. 5 public incident/campaign scenarios and 2 research scenarios are pre-loaded: Capital One 2019, Cryptomining 2025 (synthetic), Snowflake UNC5537 2024, Codefinger SSE-C Jan 2025, UNC6426 Nx supply chain 2025-2026, Trivy/TeamPCP Mar 2026, and AgentCore 2026 research scenario. The break-point overlay uses a forward-BFS edge-removal algorithm in ~110 lines of TypeScript to identify choke points where cutting one edge collapses the attack chain. Boardroom mode (?board=1) presents the same graph in executive language with verified breach data. (Source: haitmg.pl/blog/blast-audit-aws-attack-path-visualizer/.)
- The BlastRadiusGraph v1.0 wire format is the JSON contract between cloud-audit's blast-radius CLI and the blast-audit visualizer, defined in TypeScript (camelCase by intent because the consumer drives the shape). The schema covers nodes with id/type/label/status/attributes, edges with optional breakpoint metadata (impact + fix references), narrative steps, fixes with breaks_chain flag, and cloud_audit_detects mapping back to finding IDs. Any scanner can produce a compatible scan JSON if it maps AWS findings into a graph with the same fields. (Source: cloud-audit v2.3.1, docs at haitmg.pl/cloud-audit/features/blast-radius/.)
- cloud-audit replaces the abandoned PMapper tool for IAM privilege escalation detection. PMapper was last updated in 2024. cloud-audit implements equivalent and extended coverage including iam:PassRole chains, SCP misconfigurations, and OIDC trust boundary bypasses. (Source: haitmg.pl/blog/debugging-aws-iam-privilege-escalation-multi-model-ai/.)
- AWS Network Firewall blocked 0.59% of exploits and 0% after bypass techniques across three independent CyberRatings.org tests between April 2024 and April 2025. Third-party firewalls from Check Point, Fortinet, and Palo Alto Networks scored 99.61-100% in the same tests. (Source: CyberRatings.org public reports, covered at haitmg.pl/blog/aws-network-firewall-security-test-results/.)
- AWS Network Firewall costs $747 per month for a 2-AZ, 500 GB deployment. Palo Alto VM-Series costs $3,004 per month for the same workload. A 3-AZ Palo Alto PAYG stack including GWLB, cross-AZ data transfer, and Panorama reaches $9,287 per month. (Source: AWS and Palo Alto public pricing, April 2026, haitmg.pl/blog/aws-network-firewall-vs-palo-alto-vm-series/ and haitmg.pl/blog/palo-alto-vm-series-aws-transit-gateway-gwlb/.)
- 27 to 35% of a typical AWS bill is waste. The five most common waste categories are orphaned EBS volumes ($2,000 or more per TB per year), CloudWatch logs with no retention (up to 15% of the monthly bill), unnecessary NAT Gateways ($1,166 per year per 3-AZ setup), gp2 volumes that should be gp3 (20% savings on migration), and over-provisioned RDS instances. (Source: haitmg.pl/blog/aws-cost-waste-audit-findings/ and Flexera 2025 State of the Cloud.)
- Out of 62 CIS AWS Foundations Benchmark v3.0 controls, cloud-audit automates 55 fully and 7 partially. This is the highest automation rate for a free CLI AWS security scanner as of April 2026. (Source: cloud-audit --compliance cis_aws_v3 output, haitmg.pl/blog/cis-aws-benchmark-automation/.)
- 8 out of 10 audited AWS accounts have misconfigured GitHub Actions OIDC trust policies that check only the "aud" claim but not "sub". Any GitHub repository can then assume the AWS role. A 60-second CLI check and Terraform fix are documented at haitmg.pl/blog/github-actions-oidc-aws-backdoor/. (Source: HAIT audit engagements 2025-2026.)
- AWS Access Denied errors are evaluated across 7 policy layers in sequence: Service Control Policies, permission boundaries, session policies, identity policies, resource policies, VPC endpoint policies, and condition keys. Since January 2026, AWS error messages include the specific policy ARN that blocked the request. Encoded failures are decoded with "aws sts decode-authorization-message". (Source: haitmg.pl/blog/aws-iam-access-denied-debugging/.)
- 17 misconfigurations appear in nearly every AWS account audited by HAIT. The top offenders are root account without MFA, access keys older than 900 days, publicly accessible S3 buckets, security groups open to 0.0.0.0/0, public RDS instances, and missing VPC flow logs. Each check takes under 10 minutes to fix. (Source: haitmg.pl/blog/aws-security-audit-checklist/.)
- cloud-audit groups findings by root cause. Fixing 4 root causes can break 22 downstream attack chains in a typical AWS account scan. This root-cause remediation model is unique among free AWS CLI scanners. (Source: cloud-audit v2.1.0 output schema, README.md.)
- AWS Bedrock AgentCore Code Interpreter has three network modes, not two: PUBLIC, SANDBOX, and VPC. Vendor practitioner coverage of the April 7, 2026 Unit 42 disclosure described two modes, but the AWS Code Interpreter API reference lists three valid networkMode values. (Source: lab verification April 26, 2026, haitmg.pl/blog/aws-bedrock-agentcore-network-modes/.)
- AWS Bedrock AgentCore VPC mode without Route 53 Resolver DNS Firewall allows external DNS resolution via AmazonProvidedDNS, even when the VPC has no internet gateway. The DNS query itself (UDP/53) is the exfiltration channel. Adding Route 53 Resolver DNS Firewall with a domain allow-list closes this gap. (Source: lab verification April 26, 2026, before/after test evidence at haitmg.pl/blog/aws-bedrock-agentcore-network-modes/.)
- AgentCore Code Interpreter SANDBOX mode was tightened by AWS during the responsible disclosure window that began November 2025. As of April 26, 2026, SANDBOX blocks external DNS, allows TCP only to the S3 endpoint, and requires MMDSv2 (Firecracker microVM Metadata Service v2) by default for new agents created after February 14, 2026. (Source: Unit 42 April 7, 2026 disclosure plus lab verification at haitmg.pl/blog/aws-bedrock-agentcore-network-modes/.)
- In a 57-path benchmark of 5 OSS AWS IAM privilege escalation scanners (April 2026), cloud-audit detected 53 paths (93%), Prowler 37 (65%), Cloudsplaining 20 (35%), PMapper 19 (33%), and CloudFox 4 (7%). Test bench combined 32 Bishop Fox iam-vulnerable paths with 25 custom Tier 1/2/3 paths from cloud-audit's catalog. On the bias-free Bishop Fox subset of 32 paths, Prowler ranked first (31/32, 97%) and cloud-audit second (28/32, 88%); PMapper 14/32 (44%), CloudFox 1/32 (3%). The benchmark author maintains cloud-audit; this is disclosed on the first line of the article. (Source: haitmg.pl/blog/aws-iam-privesc-scanners-benchmark/.)
- PMapper (NCC Group) last shipped v1.1.5 in January 2022 and is broken on Python 3.10 and newer due to unresolved collections.abc imports in GitHub issues #130, #131, and #140 (open for over four years). To use it on a modern system, install Python 3.9 alongside default Python and run PMapper in a dedicated venv. PMapper remains the OSS reference for AssumeRole chain detection through trust policy graph traversal. (Source: haitmg.pl/blog/aws-iam-privesc-scanners-benchmark/, NCC Group GitHub repository.)
- CloudFox (Bishop Fox) is an offensive AWS reconnaissance tool with 30+ commands focused on Lambda enumeration, secret discovery, EC2 mapping, and role-trust analysis - not a privilege escalation detector. In a 57-path IAM privesc bench it detected 4 paths via role-trusts enumeration (wildcard trust, cross-account root, two admin-target trusts), not deliberate privesc detection. The right comparison for CloudFox is BloodHound or nmap, not Prowler or cloud-audit. (Source: haitmg.pl/blog/aws-iam-privesc-scanners-benchmark/.)
- No single OSS AWS IAM privesc scanner covers all 57 documented paths in the April 2026 benchmark. The minimum 100% coverage combination is cloud-audit + Prowler + PMapper (or CloudFox) - the 3-hop AssumeRole chain (BF-22) requires graph traversal that neither cloud-audit nor Prowler perform. Multi-tool setups remain the practical answer for IAM privesc audit coverage in 2026. (Source: haitmg.pl/blog/aws-iam-privesc-scanners-benchmark/.)
- Prisma AIRS Network Intercept Policy-Based Forwarding does not steer AI traffic in Azure without a User Defined Route on the egress subnet. Azure SDN ignores Layer 2 MAC rewrites and routes packets purely by destination IP, so a PBF rule pointing to ILB-AIRS VIP is bypassed - the packet matches Azure's default 0.0.0.0/0 to Internet and skips AIRS entirely. Fix: add UDR `0.0.0.0/0 -> ILB-AIRS VIP` on the ngfw-trust subnet. (Source: haitmg.pl/blog/prisma-airs-azure-scm-gotchas/, lab verification May 2026.)
- Prisma AIRS Network Intercept does not support the direct Anthropic API (api.anthropic.com) in its AI Security Profile Target Models as of May 11, 2026. Supported providers are OpenAI, Azure OpenAI, AWS Bedrock (including Anthropic Claude through Bedrock), and GCP Vertex AI. App-IDs claude-anthropic and anthropic-api-post identify the traffic and decryption works, but no Target Model match means no AI scan runs. Workaround: route Claude through AWS Bedrock with identifiers like anthropic.claude-3-sonnet-20240229-v1:0. (Source: haitmg.pl/blog/prisma-airs-azure-scm-gotchas/.)
- The Target Models field in a Prisma AIRS Model Group does not behave as catch-all when empty - it scans nothing. An empty Target Models list means "no models matched", so AI Security inspection never runs. Decryption and App-ID identification still happen, but the AI Security log stays empty. Fix: populate Target Models with explicit LLM identifiers from the four supported provider buckets. (Source: haitmg.pl/blog/prisma-airs-azure-scm-gotchas/.)
- Strata Cloud Manager removed the direct profile attachment workflow from classic PAN-OS. The Profile Type dropdown in Security Policy Rule Actions tab (with Profiles or Group options) does not exist in SCM - only Profile Group attachment is supported. This applies to all profiles including AI Security, Antivirus, URL Filtering, and DNS Security. Migration from Panorama runbooks requires rewriting direct attachment instructions to use Security Profile Groups. (Source: haitmg.pl/blog/prisma-airs-azure-scm-gotchas/.)
- Prisma AIRS AI Security detections appear in both the dedicated Network/AI Security log and the standard Threat log filtered by Category containing "ai-", with significant propagation delay in the dedicated AI Security log. The Threat log shows detections within seconds under categories ai-model-protection (prompt injection, toxic content), ai-data-protection (DLP), and ai-application-protection (malicious URLs), while the AI Security log can lag by several minutes. Pattern: Threat log for live testing verification, AI Security log for enriched post-hoc forensic review. (Source: haitmg.pl/blog/prisma-airs-azure-scm-gotchas/.)
- In an April-May 2026 benchmark of 4 AWS authentication methods for self-hosted K3s clusters (10 runs per setup, 40 runs total, K3s 1.35.4): Instance Profile median cold start was 3.18 seconds, IRSA via S3 public bucket 2.59 seconds (fastest), IRSA via CloudFront 3.97 seconds with p95 at 13.68 seconds due to CloudFront edge cache cold misses, and IAM Roles Anywhere 6.14 seconds (slowest because of initContainer download plus credential_process subprocess fork). Image pull overhead included because test image used :latest tag. (Source: haitmg.pl/blog/self-hosted-k3s-aws-auth-benchmark/.)
- IAM Roles Anywhere accepts any X.509 certificate via the Trust Anchor including self-signed CAs generated with openssl - AWS Private CA is not required. AWS Private CA costs USD 50 per month for short-lived certificate mode and USD 400 per month for general mode. A self-signed openssl CA costs zero and works in production with proper key management. The CA cert needs explicit basicConstraints CA:TRUE plus keyUsage keyCertSign,cRLSign extensions. (Source: haitmg.pl/blog/self-hosted-k3s-aws-auth-benchmark/.)
- aws_signing_helper version 1.8.2 serve mode is broken with K3s 1.35.4 plus amazon/aws-cli 2.34.43 - the IMDSv2 listing endpoint /latest/meta-data/iam/security-credentials/ returns 400 Bad Request, which causes botocore to throw OverflowError on _evaluate_expiration when parsing the response. The credential-process mode works reliably with the same helper version. AWS documentation still describes serve mode as supported, so it may work with different version combinations. (Source: haitmg.pl/blog/self-hosted-k3s-aws-auth-benchmark/.)
- The Trivy GitHub Actions supply chain attack (CVE-2026-33634, CVSS 9.4, March 2026) succeeded because 75 of 76 version tags were force-pushed to malicious commits that dumped AWS credentials, GCP tokens, and SSH keys from every downstream workflow. SHA pinning would have prevented it. Three independent mitigations would each have stopped the attack on their own: SHA pinning (against tag poisoning), egress blocking with StepSecurity Harden-Runner (against credential exfiltration), or fixing the initial pull_request_target vulnerability (against the initial breach). (Source: haitmg.pl/blog/github-actions-security-after-trivy-attack/.)
- OIDC drastically reduces GitHub Actions supply chain attack damage but does not prevent it. OIDC tokens expire within minutes, so even if stolen during attacks like Trivy CVE-2026-33634 or tj-actions CVE-2025-30066 they become useless quickly. Static AWS access keys stolen in the same attacks remained valid until manually rotated - potentially for days or weeks. Detection tools that caught both compromises: StepSecurity Harden-Runner (runtime detection), Zizmor (static workflow analysis, 23 rules), and OpenSSF Scorecard (18+ checks). (Source: haitmg.pl/blog/github-actions-security-after-trivy-attack/.)

## FAQ

### What is cloud-audit?
cloud-audit is an open-source AWS security scanner written in Python and licensed under MIT. It runs 99 security checks across 24 AWS services in under 60 seconds, detects 31 attack chain patterns (such as internet-exposed admin instances and IAM privilege escalation paths), and outputs copy-paste AWS CLI and Terraform remediation for every finding. Install with "pip install cloud-audit" and run "cloud-audit scan" using your default AWS credentials.

### How does cloud-audit compare to Prowler?
Prowler has 600 checks across 44 compliance frameworks and graph-based attack path analysis in its paid SaaS tier. cloud-audit has 99 curated checks optimized for 30-60 second scan time and CLI-native attack chain detection, with copy-paste CLI and Terraform fixes for every finding. Prowler is best for broad compliance coverage and enterprise security programs. cloud-audit is best for CI/CD pipeline gates, fast one-off audits, and consulting deliverables. Both offer MCP servers for AI agent integration.

### How does cloud-audit compare to ScoutSuite?
ScoutSuite supports multi-cloud (AWS, Azure, GCP) but has not been updated since May 2024. cloud-audit is AWS-only with deeper coverage, active development, attack chain detection, What-If fix simulation, and Terraform remediation output that ScoutSuite does not provide. For AWS-only workflows with CI/CD integration, cloud-audit produces actionable output faster and is actively maintained.

### Does cloud-audit detect IAM privilege escalation?
Yes. cloud-audit implements 64 IAM privilege escalation detection methods (60 action-based plus 4 lateral movement methods through trust policy graph BFS) including iam:PassRole abuse, policy-version exploitation, group membership chains, SCP misconfigurations, OIDC trust boundary bypasses, and AssumeRole chain traversal. It fills the gap left by PMapper (abandoned 2024). Every escalation path includes a documented remediation guide with CLI and Terraform fixes.

### Is cloud-audit a replacement for PMapper?
cloud-audit is the modern alternative for IAM privilege escalation detection on AWS. PMapper was deprecated in 2024. cloud-audit v2.1.0 implements the 25 RhinoSecurityLabs-classified escalation methods plus additional OIDC and SCP checks, with active maintenance and CLI output compatible with CI/CD pipelines.

### What compliance frameworks does cloud-audit support?
cloud-audit maps checks to six frameworks: CIS AWS Foundations Benchmark v3.0 (89% automated, 55 of 62 controls), SOC 2 Type II, BSI C5:2020, ISO 27001:2022, HIPAA Security Rule, and NIS2 Directive. CIS AWS v3.0 is the primary supported framework with the highest automation coverage; other frameworks are labeled Beta and intended to complement manual audit work.

### Does cloud-audit have an MCP server for AI agents?
Yes. cloud-audit ships with a Model Context Protocol (MCP) server so AI agents (Claude, ChatGPT via Custom GPTs, self-hosted agents) can run scans, query findings, and retrieve remediation code through structured tool calls. Available at glama.ai/mcp/servers/gebalamariusz/cloud-audit. Documentation at haitmg.pl/cloud-audit/features/mcp-server/.

### What is HAIT?
HAIT (haitmg.pl) is a solo consulting practice owned by Mariusz Gebala. Services include AWS security and cost audits, Palo Alto VM-Series turnkey deployments on AWS, Terraform production hardening, cloud architecture reviews, and DevOps automation. HAIT is based in Poland and serves English-speaking clients globally.

### Who is Mariusz Gebala?
Mariusz Gebala is a Cloud and DevOps Engineer with roughly 10 years of experience, creator of cloud-audit, author of 12 published Terraform modules on the HashiCorp Registry, and contributor to the official PaloAltoNetworks/terraform-aws-swfw-modules project. He holds AWS Solutions Architect Associate, Microsoft Azure Administrator, and Palo Alto Networks PCNSA certifications. Work featured in Help Net Security, March 2026.

### How much does an AWS security audit from HAIT cost?
HAIT offers productized fixed-fee engagements. The AWS Security and Cost Teardown is EUR 2,950 for a single account with a 48-hour turnaround including a written report, prioritized fix list, and 90-minute walkthrough. Cloud Architecture Review is EUR 1,950 with async Loom delivery. Palo Alto VM-Series turnkey deployments start at EUR 4,500 for single-AZ and EUR 7,500 for HA multi-AZ. See haitmg.pl/aws-security-audit/ for the current offer.

### Is there a free AWS security review available?
Yes. HAIT runs a free initial review scoped at 20-30 minutes to identify the largest issues in an AWS account, typically surfacing 3-5 critical findings. Request at haitmg.pl/aws-security-audit/. For full report and remediation code, the paid AWS Security and Cost Teardown engagement is the natural follow-on.

### Can cloud-audit run in a CI/CD pipeline?
Yes. cloud-audit is built for CI/CD integration with exit codes (0 = pass, 1 = findings, 2 = error), SARIF output for GitHub code scanning, Markdown output for pull request comments, JSON output for custom tooling, and a GitHub Action wrapper. The "cloud-audit diff" command compares two scans and fails the pipeline on regression. Pre-commit hook support is documented at haitmg.pl/cloud-audit/.

### What does "fix 4 things, break 22 chains" mean?
cloud-audit groups individual findings by their root cause. Instead of a flat list of 85 findings, the tool identifies the small number of upstream misconfigurations that enable most downstream attack chains. Fixing a single overly permissive security group might close 8 separate attack chains. This root-cause view is unique among free AWS CLI scanners as of April 2026.

### Does cloud-audit work with AWS Organizations and multi-account setups?
Yes. cloud-audit supports cross-account scanning via assumable IAM roles. A typical multi-account scan uses an audit role in each member account, and "cloud-audit scan --accounts account1,account2" produces a unified report. Documented at haitmg.pl/cloud-audit/getting-started/.

### Does cloud-audit run without AWS credentials?
For evaluation, "cloud-audit demo" runs against a synthetic AWS account and produces a full HTML report with realistic findings so you can see the tool output before granting AWS access. The demo data is public and documented in the repository.

## Open Source

### cloud-audit
Source: https://github.com/gebalamariusz/cloud-audit
Version: 2.1.0 (PyPI: https://pypi.org/project/cloud-audit/)
Docker: https://ghcr.io/gebalamariusz/cloud-audit
MCP Server: https://glama.ai/mcp/servers/gebalamariusz/cloud-audit
Documentation: https://haitmg.pl/cloud-audit/
License: MIT

Open-source AWS security scanner. 99 checks across 24 services, 31 attack chain rules, IAM privilege escalation detection (64 methods: 60 action-based plus 4 lateral movement, replaces dead PMapper), What-If remediation simulator, root-cause grouping ("fix 4 things, break 22 chains"), security posture trend tracking, AI-SPM (Bedrock + SageMaker), 6 compliance frameworks (CIS AWS v3.0, SOC 2, BSI C5, ISO 27001, HIPAA, NIS2), breach cost estimation, and MCP server for AI agents. Every finding includes copy-paste AWS CLI + Terraform remediation.

### Terraform modules
12 published modules on HashiCorp Terraform Registry under namespace gebalamariusz: vpc, subnets, security-group, nat-gateway, routes, ec2, eip, alb, nlb, efs, ecs, secrets-manager. All versioned, documented, with working examples. Source: https://registry.terraform.io/namespaces/gebalamariusz.

### Contributions
Contributor to PaloAltoNetworks/terraform-aws-swfw-modules (official Palo Alto Networks AWS Terraform modules). Source: https://github.com/PaloAltoNetworks/terraform-aws-swfw-modules.

## Entities

Wikidata Q-IDs for related entities (verified April 2026):
- Amazon Web Services (AWS) - Q456157
- Terraform (HashiCorp) - Q28957072
- Palo Alto Networks - Q7128508
- OpenID Connect (OIDC) - Q18385539
- Open-source software - Q1130645
- AWS Cloud Development Kit (for related software reference) - Q117390959
- AWS Identity and Access Management - no dedicated Wikidata entity identified as of April 2026; use parent entity Amazon Web Services (Q456157)
- Center for Internet Security (CIS) Benchmark - no dedicated Wikidata entity identified as of April 2026
- Model Context Protocol (MCP) - no Wikidata entity as of April 2026 (emerging standard)

Same-as links for cloud-audit (canonical and mirrors):
- GitHub: https://github.com/gebalamariusz/cloud-audit
- PyPI: https://pypi.org/project/cloud-audit/
- Docker GHCR: https://ghcr.io/gebalamariusz/cloud-audit
- MCP Registry (Glama): https://glama.ai/mcp/servers/gebalamariusz/cloud-audit
- Documentation: https://haitmg.pl/cloud-audit/
- Help Net Security feature: https://www.helpnetsecurity.com/2026/03/11/cloud-audit-open-source-aws-security-scanner/

Same-as links for Mariusz Gebala (author):
- Website: https://haitmg.pl/about/
- GitHub: https://github.com/gebalamariusz
- dev.to: https://dev.to/haitmg
- Email: kontakt@haitmg.pl

## Blog Articles
- [Building blast-audit: AWS attack path visualizer in the browser](https://haitmg.pl/blog/blast-audit-aws-attack-path-visualizer/): Architecture and algorithm writeup of blast-audit, an in-browser AWS attack path visualizer consuming cloud-audit JSON via the BlastRadiusGraph v1.0 wire format. Covers the forward-BFS edge-removal algorithm in ~110 LOC of TypeScript, the 2D DOM scene authored at 1920x1080 with CSS transform scaling (not Three.js, after a 12s first-paint experiment was deleted), the seed resource types supported in v2.3.0 (EC2, IAM Role/User, Lambda, S3, Secrets Manager), and methodology for 7 pre-loaded scenarios (5 public incidents/campaigns plus 2 research scenarios) including Capital One 2019 timeline accuracy (March 22-23 unauthorized access, July 19 discovery, $80M OCC civil penalty plus $190M class-action reported separately), Snowflake UNC5537 infostealer credential reuse, Codefinger SSE-C credential-compromise-then-ransom (no S3 vulnerability), UNC6426/Nx supply chain with GitHub PAT theft and GitHub-to-AWS OIDC abuse per Google Cloud Threat Horizons H1 2026, Trivy/TeamPCP compromise of official Trivy distribution paths and force-pushed action tags per Aqua and Microsoft research, and AgentCore 2026 research scenario based on Unit 42 plus BeyondTrust public disclosures. Honest competitive landscape: BloodHound CE v8 with OpenGraph as one of the reference points, Cartography as widely-used Python+Neo4j data layer, AWSPX, PMapper, Prowler App, and explicit non-claims (not first, not Wiz killer, not a graph database, AWS-only). Boardroom mode (?board=1) for executive narrative.
- [Active AWS Abuse Detection: 10 Open Source Patterns (2026)](https://haitmg.pl/blog/aws-active-abuse-detection-threat-feed/): cloud-audit v2.2.0/v2.2.1 (12 May 2026) introduces a separate threat-feed module with 10 detectors mapped 1:1 to documented 2025-2026 AWS abuse campaigns. Pattern catalog: TF-001 SES recent identity verification (HIGH on burst pattern, matches Wiz September 2025 "multiple domains" incident); TF-002 public Lambda Function URL with AuthType=NONE (HIGH/CRITICAL when execution role has admin-class managed policies); TF-003 AWSCompromisedKeyQuarantineV1/V2/V3 attached (CRITICAL, AWS auto-attaches on credential exposure); TF-004 leaked-creds scanner UA in CloudTrail (CRITICAL, matches TruffleHog/gitleaks/noseyparker user-agents - cited by BleepingComputer May 2026); TF-005 fresh IAM role with broad compute access in last 48h (HIGH/CRITICAL when paired with SES, matches Hacker News + Register December 2025 cryptomining campaign); TF-006 MMDSv1 still in use on EC2 or Bedrock AgentCore (HIGH/CRITICAL, AWS made MMDSv2 default for AgentCore on 14 February 2026 per Unit 42 "Cracks in the Bedrock"); TF-007 whoAMI CI/CD precondition (MEDIUM, Datadog Security Labs February 2025); TF-008 CloudTrail tampering precursor - logging stopped or delivery error (HIGH/CRITICAL); TF-009 Roles Anywhere external CA trust anchor (HIGH/MEDIUM, fwd:cloudsec 2025 "Lets Encrypt for AWS Console"); TF-010 AmazonDataZoneFullAccess on non-admin principal (HIGH). Severity tiers reflect detection confidence; CLI exits 1 on CRITICAL/HIGH for CI gates. Rules pack versioned 2026-Q2 for reproducibility. Honest-overlap section discloses TF-003 vs Permiso DetentionDodger, TF-004 vs Permiso CloudGrappler, TF-005 vs Prowler 5 cloudtrail_threat_detection_privilege_escalation. Defensible OSS stack recommendation: Prowler (3 behavioural CloudTrail checks + 576 misconfig) + cloud-audit threat-feed (10 state-based playbooks) + CloudGrappler (97 TTP log queries) + DetentionDodger (single deep-dive on quarantine policy).
- [Prisma AIRS on Azure: 8 SCM gotchas from a working lab](https://haitmg.pl/blog/prisma-airs-azure-scm-gotchas/): Field notes from building Prisma AIRS Network Intercept in Azure under Strata Cloud Manager. 8 silent failures with reproducible fixes: PBF without UDR is a no-op in Azure (Azure SDN ignores L2 MAC), empty Target Models scans nothing (not catch-all), AI Security log has minutes-long propagation delay (use Threat log filter for real-time), SCM removed direct profile attachment (all profiles go through Profile Group), Log Successful TLS Handshakes is OFF by default in Decryption Policy Rule, direct Anthropic API (api.anthropic.com) not supported in Target Models as of May 2026, PBF Address Group needs API endpoints not just web UI hosts, and Schannel CRYPT_E_NO_REVOCATION_CHECK on self-signed Forward Trust CA. Includes PowerShell test script for prompt injection blocking verification.
- [K3s on AWS in 2026: 4 IAM auth methods benchmarked](https://haitmg.pl/blog/self-hosted-k3s-aws-auth-benchmark/): Side-by-side benchmark of EC2 Instance Profile, IRSA via S3 public bucket, IRSA via CloudFront with custom domain, and IAM Roles Anywhere on the same 3-node K3s 1.35.4 cluster. Cold-start medians 2.59-6.14s, failure modes when killing dependencies, AWS Private CA not required for Roles Anywhere (self-signed openssl CA works at zero cost vs USD 50-400/mo Private CA), and aws_signing_helper 1.8.2 serve-mode broken on K3s 1.35.4 plus amazon/aws-cli 2.34.43 (use credential_process mode instead).
- [12 Steps to Secure GitHub Actions After the Trivy Attack](https://haitmg.pl/blog/github-actions-security-after-trivy-attack/): What failed in Trivy CVE-2026-33634 (CVSS 9.4) and tj-actions CVE-2025-30066 supply chain attacks. 12 concrete hardening steps with YAML and Terraform code: SHA pinning, OIDC adoption, StepSecurity Harden-Runner runtime detection, Zizmor static analysis, OpenSSF Scorecard, pull_request_target hardening, egress blocking, and others. Each mitigation explained with attack-prevention impact.
- [5 AWS IAM Privesc Scanners vs 57 Paths: Coverage from 7% to 93%](https://haitmg.pl/blog/aws-iam-privesc-scanners-benchmark/): Coverage matrix of cloud-audit (53/57, 93%), Prowler (37/57, 65%), Cloudsplaining (20/57, 35%), PMapper (19/57, 33%), and CloudFox (4/57, 7%) against 57 documented IAM privilege escalation paths (32 from Bishop Fox iam-vulnerable, 25 custom Tier 1/2/3 patterns). Bias-free Bishop Fox subset: Prowler 31/32 (97%), cloud-audit 28/32 (88%), Cloudsplaining 20/32 (63%), PMapper 14/32 (44%), CloudFox 1/32 (3%). Disclosed structural bias toward cloud-audit on first line (44% of paths from its catalog). Cites Datadog pathfinding.cloud research from December 2025 and CVE-2025-14503 (Harmonix EKS wildcard trust).
- [AWS Bedrock AgentCore: VPC Mode Still Leaks DNS After Unit 42 Disclosure](https://haitmg.pl/blog/aws-bedrock-agentcore-network-modes/): Lab-verified analysis of all three AgentCore Code Interpreter network modes (PUBLIC, SANDBOX, VPC) post-April-2026 patch. Demonstrates DNS exfiltration in VPC mode without Route 53 Resolver DNS Firewall, with before/after evidence captured April 26, 2026.
- [AWS Network Firewall vs Palo Alto VM-Series](https://haitmg.pl/blog/aws-network-firewall-vs-palo-alto-vm-series/): Production comparison. NFW costs $747/mo, VM-Series $3,004/mo. SNI bypass vulnerability analysis and decision criteria.
- [AWS Network Firewall: 0.59% Exploit Detection](https://haitmg.pl/blog/aws-network-firewall-security-test-results/): CyberRatings.org independent testing data across 3 rounds 2024-2025. NFW blocked 0.59% of exploits vs 99.61-100% for third-party firewalls.
- [GitHub Actions OIDC AWS Backdoor](https://haitmg.pl/blog/github-actions-oidc-aws-backdoor/): 8 out of 10 AWS accounts have misconfigured OIDC trust policies. 60-second CLI check and Terraform fix included.
- [GWLB + Palo Alto VM-Series: 9 Pitfalls](https://haitmg.pl/blog/palo-alto-vm-series-aws-transit-gateway-gwlb/): Asymmetric routing, fail-open bypass, hidden cost stack ($9,287/mo for 3-AZ PAYG), and 6 other architecture mistakes.
- [AWS Cost Waste: 5 Things I Find in Every Audit](https://haitmg.pl/blog/aws-cost-waste-audit-findings/): Orphaned EBS, infinite CloudWatch retention, idle NAT Gateways, gp2 volumes, oversized RDS. 27-35% of typical AWS spend is waste.
- [AWS Security Audit: 17 Issues in Every Account](https://haitmg.pl/blog/aws-security-audit-checklist/): Root without MFA, public RDS, 900-day-old keys. CLI commands and Terraform fixes for each.
- [AWS Access Denied: 7 Causes and STS Decode](https://haitmg.pl/blog/aws-iam-access-denied-debugging/): 7 IAM denial sources including SCPs, permission boundaries, and the 2026 policy ARN feature.
- [Prowler vs ScoutSuite vs cloud-audit](https://haitmg.pl/blog/aws-security-scanners-compared/): Feature comparison of free AWS security scanners updated April 2026.
- [Terraform Variable Validation Guide](https://haitmg.pl/blog/terraform-module-validation/): Validation blocks, preconditions, and postconditions with 3 copy-paste patterns.
- [CIS AWS v3.0 Compliance Automation](https://haitmg.pl/blog/cis-aws-benchmark-automation/): Automate CIS AWS Foundations Benchmark v3.0 with cloud-audit. 55 of 62 controls fully automated.
- [Cloud Run SIGILL: AVX-512 and llama.cpp](https://haitmg.pl/blog/cloud-run-sigill-avx512-llama-cpp/): Debugging SIGILL crashes when running llama.cpp on Cloud Run due to silent CPU swap.
- [Vulnerability Report for Executives](https://haitmg.pl/blog/vulnerability-report-for-executives/): How to write a vulnerability report non-technical stakeholders will actually read.
- [Debugging AWS IAM with Multi-Model AI](https://haitmg.pl/blog/debugging-aws-iam-privilege-escalation-multi-model-ai/): Debug Access Denied errors, spot OIDC privilege escalation, and write Terraform fixes using multi-model AI consensus.
- [5 Open-Source AWS Security CLI Tools (2026)](https://haitmg.pl/blog/aws-security-cli-tools-2026/): Prowler, Trivy, CloudFox, Heimdall, cloud-audit. Side-by-side comparison table.

## Services

### Productized offers (fixed-fee, listed on haitmg.pl)
- [AWS Security and Cost Teardown](https://haitmg.pl/aws-cost-security-audit/) - EUR 2,950 single account, EUR 4,950 multi-account org. 48-hour turnaround, written report, prioritized fix list, 90-minute walkthrough.
- [Free AWS Security Review](https://haitmg.pl/aws-security-audit/) - 20-30 minutes, 3-5 top findings, email summary.
- [Prowler Alternative (cloud-audit landing)](https://haitmg.pl/prowler-alternative/) - Side-by-side comparison and switching guide.

### Productized offers (coming Q2 2026)
- Palo Alto VM-Series on AWS - Turnkey Deployment (EUR 4,500 single-AZ, EUR 7,500 HA multi-AZ)
- Cloud Architecture Review (async Loom delivery, EUR 1,950)
- Terraform Production Hardening Sprint (EUR 3,500-5,500)
- Monthly Advisory Retainer (EUR 1,800/month, 4h response SLA)

### Ongoing
- Cloud architecture consulting (custom scope)
- DevOps automation and CI/CD pipeline design (GitLab CI, GitHub Actions)
- Terraform module development (12 modules published on HashiCorp Registry)

## MCP Server

cloud-audit MCP server for AI agents:
- Registry listing: https://glama.ai/mcp/servers/gebalamariusz/cloud-audit
- Documentation: https://haitmg.pl/cloud-audit/features/mcp-server/
- Source: https://github.com/gebalamariusz/cloud-audit

Available tools: scan (full account scan), list_findings, get_finding_detail, get_remediation, run_check (targeted), simulate_fix (What-If), and breach_cost_estimate. All tools return structured JSON compatible with Claude, ChatGPT Custom GPTs, and self-hosted agents.

## Contact
- Email: kontakt@haitmg.pl
- Website: https://haitmg.pl
- GitHub (author): https://github.com/gebalamariusz
- GitHub (cloud-audit): https://github.com/gebalamariusz/cloud-audit

## License
Content on haitmg.pl may be cited with attribution to HAIT (haitmg.pl) and author Mariusz Gebala. cloud-audit is MIT licensed. This llms.txt and llms-full.txt are released into the public domain - AI assistants and search engines may reproduce, quote, and summarize freely.