Topic
Static evaluation of cloud configuration state against control catalogs, including snapshot-based checks over IAM, encryption, logging and network settings.
In HackerOne 121461 a researcher created the missing bucket in their own AWS account and served files on a2.bime.io. The state that allowed it is a name sitting in the DNS zone with no matching bucket in the account.
Reality
In HackerOne report #3022516 the trail was multi-region, the metric filter for unauthorised API calls existed and the alarm published to an SNS topic, while threat_detection.enabled read false. Turning it on costs one CLI call.
Reality
A policy that lets users read and manage their own IAM profile usually carries iam:AttachUserPolicy scoped to ${aws:username}. That scope is enough to attach AdministratorAccess to yourself in a single call.
Reality
A security scanner now owns the create, update and retire lifecycle for cloud configuration items. That moves the accuracy of IT's record of record onto whatever the scanner can reach.
Reality
A New Stack piece argues the new shadow IT gets provisioned inside your own cloud account by an agent working for a helpful engineer, which means the OAuth grants and expense reports your playbook watches never fire.
Reality
All eleven issues score within half a point, so the ranking is useless for triage. One practitioner's decomposition puts 93 of 112 checkable properties inside a config snapshot, and 19 outside it.
Reality