DEV Community: Sankalp Sandeep Paranjpe

Vulnerability Management using Amazon Inspector

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:31:39 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

Vulnerability Management using Amazon Inspector

Created on 2023-05-29 19:05

Published on 2023-05-30 05:39

Amazon Inpector is a service provided by AWS for Vulnerability Management. It continuously scans your infrastructure workloads for vulnerabilities. These vulnerabilities can be Software Package vulnerabilities, Network reachability scans etc. Amazon Inspector scans Amazon EC2 instances, Amazon Elastic container registry, and now AWS Lambda functions also. The result of the scan is called the findings.

How does Amazon Inspector work?

Following is the process of scanning using AWS Inspector -

Agent Installation on the instance.
Define Assessment templates.
Assessment runs and Vulnerability scanning process.
Findings and Risks Scoring system.
Prioritise vulnerability and Remediation of Vulnerabilities.

Features of Amazon Inspector-

1) Integration with other services like AWS Security Hub, and AWS Event Bridge to automate the security workflow.

Inspector findings can be automatically sent to AWS Security Hub, which acts as a centralized hub for security-related findings and insights across your AWS environment. Security Hub provides a comprehensive view of your overall security posture. For example, you can configure Security Hub to trigger an automated response when critical or high-risk findings are detected. This automation can include actions like sending notifications, generating tickets, or triggering remediation processes.

2) Automated Vulnerability Assessment

The software package vulnerabilities include finding identified from AWS workloads that are exposed to Common Vulnerabilities and Exposures, CVEs. Network reachability findings reveal that there are accessible network paths to your Amazon EC2 instances within your environment. These findings bring attention to network configurations that may be excessively permissive, such as poorly managed security groups, Access Control Lists, or internet gateways, which could potentially allow for unauthorized access or malicious activity.

3) All findings

The "All findings" table provides a comprehensive compilation of all active findings within your environment. This inclusive table encompasses various finding types based on the Amazon Inspector scanning configurations you have activated, including Package and Network Reachability findings for Amazon EC2 instances, as well as Package vulnerabilities for Amazon ECR container images and Lambda functions.

4) Vulnerability Scores

AWS Inspector assigns a risk score, ranging from 0.0 to 10.0, indicating the potential impact and risk it poses to your environment. These findings are categorized into different severity of vulnerabilities.

Critical: Findings with a risk score of 9.0-10.0 signifies critical risks.
High: Findings with a risk score of 7.0-8.9 signifies high-risk discoveries.
Medium: Findings with a risk score of 4.0-6.9 signifies moderate-risk observations.
Low: Findings with a risk score of 0.1-3.9 signifies low-risk identifications.
Informational: Findings with a risk score of 0.0 signifies informational findings.

You can find these vulnerabilities by :

By vulnerability: This view presents a list of the most critical vulnerabilities identified. You can select a vulnerability title to access additional details in a separate pane.

By account: This view is exclusive to delegated administrators and provides a list of your accounts. It showcases the Amazon Inspector scan coverage percentage for each account, as well as the total count of Critical and High severity findings in each account.

By instance: This view highlights the most vulnerable Amazon EC2 instances within your environment.

By container image: This view lists the most vulnerable Amazon ECR container images present in your environment.

By container repository: This view focuses on the repositories that have the highest number of vulnerabilities.

By Lambda function: This view displays the Lambda functions that have the most vulnerabilities.

5) Vulnerability Database search

Using this feature, we can search if AWS Inspector covers particular CVEs in the scans or not. It will give you data from the National Vulnerability database data, CVSS Score, and EPSS score.

6) Suppression Rules:

A suppression rule serves as a predefined set of filter criteria that effectively excludes findings meeting those criteria from appearing in your active findings lists. By automatically changing their status from "Active" to "Suppressed," these findings are prevented from triggering unnecessary alerts or cluttering your Amazon Inspector findings lists. Suppression rules are particularly useful for eliminating low-value findings or findings that are irrelevant to your specific environment.

7. Account Management

The Account management page on the Amazon Inspector console is a valuable resource for assessing and interpreting the coverage of Amazon Inspector in your AWS environment. It helps us to manage aggregate statistics, resource-level statistics, delegated administrative access, etc.

Hence, we studied and learned about Vulnerability Management using Amazon Inspector. With features such as automated discovery, continual scanning, and centralized management, Amazon Inspector provides near real-time vulnerability findings and a comprehensive view of security posture. Hence, Amazon Inspector is an important service.

Let's connect,

Unlocking AWS Credits: A Comprehensive Guide

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:26:34 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

Unlocking AWS Credits: A Comprehensive Guide

Created on 2024-01-15 15:11

Published on 2024-01-15 15:30

In this blog, we will explore different AWS Program for AWS Credits. AWS credits are promotional vouchers provided by AWS to students, professionals, startups, etc. These credits can be applied to your AWS account and then you can create small-small PoCs. You can redeem these credits in your Billing and Cost Management Dashboard These credits act as a financial incentive for you.

Steps for utilizing and redeeming AWS Credits -

How to get AWS Credits?

1) AWS Proof of Concept Program - AWS credits of up to $1500, receive AWS technical support for assistance and best practices provided by AWS Partners.

2) AWS Sponsored Hackathon - An AWS-sponsored hackathons are the events event where participants come together to leverage AWS Services to create innovative and impactful solutions, allowing participants to showcase their skills and compete for prizes and get AWS Credits.

3) AWS credits packages for early-stage startups -

AWS Activate Founders-

This is a program within AWS Activate tailored for early-stage startups.
It offers a range of credits, technical support, training, and other benefits to help founders kickstart their businesses on the AWS cloud platform.
Startups in their early stages can apply for AWS Activate Founders and gain up to $1000 AWS Credits.

AWS Activate Portfolio-

This component is designed for Self-funded or funded pre-series B startups that have progressed beyond the initial stages and have a developed product or service, in the past 10 years.
AWS Activate Portfolio provides credits of $1,00,000.

4) AWS Community Programs - Amazon Web Services (AWS) has various community programs - AWS User Group Leaders, AWS Cloud Club Captains, AWS Heroes, AWS Community Builders. As a part of these community programs, AWS supports the individual in their learning by providing AWS Credits.

https://aws.amazon.com/developer/community/

5) AWS Cloud Credits for Research - These credits are provided to scientists and researchers for their research and Proof of Concept work. Following is the eligibility for them - Full-time faculty members, students and research staff at accredited research institutions. Students would be awarded up to $5000 of AWS Credits.

https://aws.amazon.com/government-education/research-and-technical-computing/cloud-credit-for-research/

6) AWS Credits for Non Profit - These are for non-profits. In this non profits get access to a maximum of $5,000 in AWS Credits. This enables nonprofits to pursue their goals without worrying about investments for their cloud infrastructure costs.

https://aws.amazon.com/government-education/nonprofits/nonprofit-credit-program/

In conclusion, AWS Credits emerge as a powerful catalyst for organizations and individuals They provide financial flexibility. These credits play a pivotal role in shaping the success of ventures large and small.

Thanks,

Sankalp Sandeep Paranjpe,

AWS Cloud Captain, Pune, India

Let's connect on LinkedIn - https://www.linkedin.com/in/sankalp-s-paranjpe/

Securing your Terraform IaC with tfsec

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:26:32 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

Securing your Terraform IaC with tfsec

Created on 2025-07-16 18:53

Published on 2025-07-17 15:30

Hello everyone,

Hope you all are doing well. I'm back with another exciting blog on Securing your terraform IaC with tfsec. In this blog we will learn about -

✅ Scanning Terraform projects with tfsec
🔁 Blocking PRs with GitHub Actions

Let's dive in!

tfsec is an open-source security scanner for Terraform created by Aqua Security. It inspects your code for:

Misconfigured resources
Insecure defaults
Compliance issues (CIS, PCI, NIST, etc.)

And most important of all, it smoothly integrates into local dev workflows and CI/CD pipelines.

Let's see how exactly it works!

For the purpose of a brief demonstration, let's intentionally create a Terraform configuration that includes deliberate misconfigurations and insecure default settings, in order to illustrate security pitfalls that can arise from improper infrastructure-as-code practices.

main.tf

s3 module

security group module

Now, let's install tfsec.

Though I had previously installed it

Now, let's run a scan locally -

Now, Let's write a simple github action to utlize tfsec . for that, create a .github folder and inside that create a workflows folder. After that create tfsec.yaml file.

Let's see how it works when it is triggered.

Now, since we want to enforce this on every Pull Request for Main branch, we will create a branch protection rule.

Or You can create it on from UI as well.

Now we will be able to see it running on every PR, and if it doesn't passes, you won't be able to merge.

Now, one more feature is to use tfsec-commenter GitHub Action as well. We will see that in next blog.

Screenshot from Official Repo from Aquasecurity. \

Another way is to use VS Code extension -

That's it for this blog. See you all soon!

Thanks,

Regards,

Sankalp Sandeep Paranjpe

https://www.linkedin.com/in/sankalp-s-paranjpe/

My experience volunteering at AWS Community Day Pune 2024 - DevSecOps Edition

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:21:28 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

My experience volunteering at AWS Community Day Pune 2024 - DevSecOps Edition

Created on 2024-01-10 16:57

Published on 2024-01-11 04:00

In the vibrant heart of Pune, the AWS User Group Pune took center stage, presenting an unparalleled tech spectacle – AWS Community Day Pune 2024 DevSecOps Edition. I was lucky enough to be a part of this fantastic day, working in organizing team as a volunteer, filled with tech wonders, shared wisdom, and a whole lot of excitement.

From the early planning stages, the AWS UG Pune team was a symphony of ideas and dedication. Collaborating with fellow tech community enthusiasts, each strategy meeting brought us closer to orchestrating a tech extravaganza. Great to work with AWSome team - Our Leads, Dheeraj Choudhary Sir, Vishal Alhat ☁️ Sir, and volunteers, Pulkit Kshirsagar Sir, Reshma Jagtap, Aditi Dhepe, Soham Dhande, Devangi Kacha Mam, Swapna Aware Mam, Nandini Pajgade, Akshay Ithape Sir.

The event commenced with an inspiring welcome note by Ridhima Kapoor, Developer Marketing Manager, AWS, followed by a keynote address by Siddhesh Keluskar, Head of Solutions Architect, AWS, establishing the rhythm for a day steeped in knowledge. Esteemed speakers, including industry leaders and AWS experts, Vandana Verma Ma'am, Vishal Alhat ☁️ Sir, Jones Zachariah Noel N Sir, Smita Singh Ma'am, Akshay Ithape Sir, Ashish Kumar Sir and Abhinav Dubey Sir, graced the stage to share insights on DevSecOps, cloud computing, and the latest advancements from AWS, Best practices were shared, and suddenly, things that sounded complicated became clear and doable.

Being part of the organizing team at AWS Community Day Pune 2024 DevSecOps Edition wasn't just a role; it was an incredible journey into the heart of tech enthusiasm. As a volunteer, I got a unique view of how a tech spectacle like this comes together.

Between ensuring sessions ran smoothly, assisting attendees, and managing the logistics, I found myself connecting with like-minded volunteers. It wasn't just about the tasks at hand; it was about building connections with people who share the same passion for technology.

One of the great opportunity was hosting a quiz on stage with Vishal Alhat ☁️ Sir. Grateful for the enriching experience and a big thanks to him for this chance. These moments make being part of the AWS community truly special!

As the event wrapped up, there was a sense of accomplishment. Every volunteer received a heartfelt thank you, and we left with not just memories but also exclusive event goodies. It was a token of appreciation that made the whole journey even more special.

AWS Cloud Club - MIT ADTU Students attended AWS Community Day Pune 2024.

After the event, we decided to chill out and have some fun at Tikona Farms. It was a great way to unwind, share stories, and enjoy each other's company. The peaceful surroundings added to the good vibes, making it a perfect ending to a fantastic day!

Being part of the AWS User Group Pune's organizing team for the DevSecOps Edition was more than volunteering; it was being part of a tech community that values collaboration and knowledge-sharing. As I look back, I'm not just a volunteer; I'm a proud contributor to an event that brought people together through a shared love for technology. Thank you Dheeraj Choudhary Sir and Vishal Alhat ☁️ Sir.

Thank you Jen Looper Tracy Wang and all AWS Academic Advocacy team members for AWS Cloud Clubs Programs.

Reflecting on this journey in the team, I'm not just reminiscing about an event; I'm cherishing the shared journey of passion, dedication, and tech excellence. Here's to the AWS User Group Pune team, the tech enthusiasts, and the future chapters of tech brilliance in Pune.🚀

Thank you,

Sankalp Sandeep Paranjpe

https://www.linkedin.com/in/sankalp-s-paranjpe/

My Experience - AWS Summit Bengaluru 2024

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:21:26 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

My Experience - AWS Summit Bengaluru 2024

Created on 2024-05-23 16:36

Published on ---

ello everyone,

Today, in this blog, I will share my AWSome experience at the Amazon Web Services (AWS) Summit Bengaluru 2024 Technical Edition on 16th May 2024. It was a great opportunity for me to learn, and network with people at the Summit. Thank you Jen Looper and Ridhima Kapoor this great opportunity. Here’s a glimpse into my experience at this spectacular event.

At precisely 8:02, I checked into the Sheraton Grand Hotel in Whitefield. The venue was bustling with energy, filled with professionals, enthusiasts, and industry leaders all eager to explore AWS Innovations. I got my ID card and went right to the entrance.

It was great to meet Ridhima Kapoor Ma’am, just before the Keynote Session. At 10 AM, the keynote sessions began. Santanu Dutt , Head of Technology for APJ at Amazon Web Services, kicked off by discussing how AWS is assisting customers across various domains such as healthcare, automotive, and gaming. Following him, Reema Jain , Chief Information and Digital Officer at Hero MotoCorp, shared their journey of gathering information and performing analytics to create a personalized experience for bike users. Next, Rajat Bansal , CTO of Games24x7, enlightened us on how they autoscale and manage the substantial traffic on their applications during the IPL season. I found that emphasis on generative AI and data was evident throughout these sessions, highlighting the transformative potential of these techs.

After that with Parth Patel and Raghul Gopal our Ex-Cloud Captains, it was AWSome to visit different booths at Builders Zone and Developer Lounge. Here is my Generative AI Photograph.

My Gen AI Photograph

At the Silver Sponsor hall, I met our AWSome Community Leaders - Dheeraj Choudhary, Vishal Alhat and Sandip Das. Here’s a picture with them. We sat and had a nice chat.

It was nice to visit at different company booths - Datadog , MongoDB , New Relic , Dynatrace , Snowflake , Databricks , Neo4j , AppSquadz , Crayon , SoftwareOne India , Sysdig, SingleStore, ScyllaDB, Terradata, SentinelOne , Coralogix , HashiCorp, Confluent, WEKA, Operisoft Technologies Pvt Ltd , Snyk, CloudifyOps, ManageEngine Site24x7, SUSE, and many other companies.

Here is my picture from startup Central -

Being always interested in security, I attended “How teams can strengthen security using Generative AI” by Lalit Kumar , Principal Security Architect, AWS. Thank you Shripad Dhole Sir, for referring Lalit Sir. His session was very informative.

One of the most notable aspects of the summit was the Developer Lounge. In this vibrant space, I had the opportunity to meet AWS User Group leaders, AWS Community Builders, AWS Cloud Captains, and AWS Heroes from all over India. I gained a wealth of knowledge from their experiences.

It was great to meet you - Shafraz Rahim Ridhima Kapoor Dheeraj Choudhary Vishal Alhat ☁️ Sandip Das Sridevi Murugayen Bhuvaneswari Subramani Nilesh Vaghela Jones Zachariah Noel N Avinash Dalvi Dimple Vaghela Omshree Butani Vijayaraghavan (Vijay) Vashudevan Omshree Butani Akshay Ithape Vikramadityasinh Puwar Dulari Bhushan Bhavesh Wadhwani Adit N Modi Zameer Fouzan @ayyanar Jeyakrishnan,

The panel discussion was mind-blowing. Sandip Das, an AWS Hero, shared valuable tips on content creation. Sridevi Ma'am discussed how she balances her company responsibilities with her contributions to the AWS Community. Dheeraj Sir, alongside Vishal Sir, talked about building a great team and managing large community events, with a focus on local social responsibility. Bhuvaneshwari Ma'am, another AWS Hero, shared inspiring stories from her community journey. As an AWS Cloud Captain, this discussion was incredibly informative and will greatly influence my own community journey. The insights and experiences shared were invaluable, and I look forward to implementing them in my future. Talks by Dimple Vaghela Mam and Jones Sir were inspiring and informative.

Introduction to DevSecOps

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:16:21 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

Introduction to DevSecOps

Created on 2023-05-20 14:21

Published on 2023-05-20 15:50

DevSecOps is a DevOps approach that integrates security practices into the DevOps pipeline. The objective of DevSecOps is to integrate and streamline security measures at every stage of the software development lifecycle, instead of considering security as an independent and distinct phase at the end.

The "DevSecOps" combines Development, Security, and Operations, reflecting the integration of these three aspects into a unified and continuous process.

The following are the principles of DevSecOps :

Shift-Left Security: DevSecOps encourages addressing security concerns early on in the software development life cycle. By integrating security practices at an early stage of the pipeline, potential bugs or vulnerabilities can be addressed before they escalate into costly issues in subsequent phases later.
Continuous Security Monitoring: DevSecOps advocates for ongoing security monitoring throughout the software development lifecycle. This involves actively monitoring for security threats and vulnerabilities in real-time, enabling quick detection and response to potential security incidents.
Automation of Security: Automation plays an imp role in DevSecOps. Wherever it is possible, automate automate and automate. Security checks, tests, and scans are automated scans as part of the secure pipelines, facilitating continuous security monitoring of the pipeline. This approach facilitates the quick identification of security issues and enables their remediation in a timely manner.
Compliance as Code: DevSecOps encourages the use of code-based policies and configurations to ensure compliance with security standards and regulations. IaC tools like Terraform etc. can be used to define and consistently enforce security controls in the infrastructures.
Collaboration: DevSecOps encourages close collaboration between all three teams, the development, the security, and the operations teams. By involving security experts throughout the development process, teams can share knowledge, align priorities, and ensure that security considerations are integrated into every step of the pipeline.

Now we will see how the security is implemented in each phase:-

First Phase: Planning and Development -

Threat modeling to identify potential security risks and design security controls.
Define your security requirements and objectives for the project.
According to your requirements, establish security policies, standards, and guidelines that align with security best practices and compliance requirements.
While coding, you can use IDE security plugins and pre-commit hooks.

Second phase: Committing the Code -

Implement security unit tests and functional tests
Use secure development practices such as input validation, output encoding, secure configuration management, etc.
Perform security code reviews and static application security testing (SAST)
Integrate security testing tools into the development pipeline to automate security checks, such as dependency analysis.

Third Phase: Building & Testing-

Automate the build process to ensure consistent and secure build environments.
Use secure repositories and artifact management tools to securely store and manage software components and dependencies.
Perform security testing, including dynamic application security testing (DAST) and penetration testing, to identify vulnerabilities and security weaknesses in the pipeline.
Conduct security-focused test scenarios, such as authentication and authorization testing, input validation testing, and security boundary testing.
Automate security testing and integrate it into the continuous integration/continuous delivery (CI/CD) pipeline.

Fourth Phase: Deploy Phase-

Implement secure deployment practices by leveraging infrastructure as code (IaC) and configuration management tools to ensure consistent and secure infrastructure configurations.
Apply secure deployment patterns, such as blue-green deployments and canary releases, to minimize the impact of security incidents.
Employ secrets management practices to securely handle sensitive information, such as passwords, API keys, secret keys and encryption keys.

Fifth Phase: Operate Phase-

Implement continuous security monitoring and log analysis to detect and respond to security incidents promptly.
Establish incident response processes that enable rapid incident detection and its response.
Conduct vulnerability scanning, vulnerability assessments, and penetration testing to identify new security vulnerabilities.

Hence we have studied and learned about the DevSecOps pipeline and all the processes involved in it.

Thanks for reading,

Let's connect on LinkedIn,

Implementing Amazon Cognito Authentication for Grafana

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:16:18 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

Implementing Amazon Cognito Authentication for Grafana

Created on 2025-03-15 13:29

Published on 2025-03-15 14:52

In this guide, we’ll walk through implementing Amazon Cognito Authentication for Grafana.

There are 4 high-level key steps -

1) Setting up Grafana on ubuntu EC2 instance.

2) Creating Amazon Cognito User Pool, App client.

3) Setting up Nginx Reverse Proxy and using Certbot for SSL

4) Updating Grafana Configurations to use Cognito Authentication

Let’s dive in.

Let's create a ubuntu machine and install necessary packages and Grafana on it.

Add Grafana APT Repository -

Install Grafana -

Enable, start and verify Grafana Service -

Now, We will be creating a Route53 A record for your machine IP. This will help us further. I already have a domain name with me - awsverse.xyz

On AWS Console, go to Amazon Cognito Service. We will have to provide a name, a configuration option for sign-in identifiers and required attribute for sign up. We will be selecting email here as we want our users to use email to sign in.

Creating Amazon Cognito User Pool

Next, to create an app client, we will go to the "App integration" section, click "Create an app client", provide a name, configure authentication settings, and enable necessary OAuth flows. Finally, we will update the app client settings to allow required authentication flows and save the configuration.

Now we have created Amazon Cognito User Pool, App Client and have made necessary changes to the configurations.

We will be using Nginx as a reverse proxy. Nginx will handle client requests and forward them to the Grafana services while optimizing performance and security. In Callback URLs, only HTTPS is supported. So, For SSL/TLS encryption, we will use Certbot, a free and automated tool provided by Let’s Encrypt, to generate and manage SSL certificates. Certbot ensures that our remains secure by enabling HTTPS, encrypting data in transit. This setup enhances both security and performance, providing a seamless and secure user experience.

Create a file /etc/nginx/sites-available/grafana.conf with the following content:

Enable and test the configuration. Also, restart the nginx service again.

Successfully deployed the certificate using Certbot

Use Certbot to generate and deploy the certificates. Below is the command the reference image is above.

Grafana Login Page

We will be able to see the Grafana Login Page.

Now, we have to implement the Amazon Cognito Authentication. For that we need to make modifications in /etc/grafana/grafana.ini file.

Before that we check and configure a domain in the Amazon Cognito console.

Domain

Now, we will update the /etc/grafana/grafana.ini file. We will get all of these details from the Amazon Cognito Console. Here's how the grafana.ini file looks like after adding the AWS Cognito related configurations.

Save the file and restart the Grafana Service.

After that go to Amazon Cognito Console, and update the callback URL, logout URL and scope.

Update Callback URL and Sign Out URL

After that go to the Grafana webpage and refresh it. You will be able to see the option to sign in using Amazon Cognito.

Grafana Login Page

When you click "Sign in with AWS Cognito", it will redirect you to the Managed Login Page of Amazon Cognito.

Cognito Managed Hosted UI

Now, we will go and create a user for us. The user will get confirm once we login.

Users in Amazon Cognito Console

Using the email id and password we will be able to login to the Grafana. Following is the URL which is redirect when we click "Sign in with Amazon Cognito"

Grafana Home Page after Login

Here is how I have configured Authentication Method and Password Policy.

Authentication Methods - Emaill

Password Policy

Also, I will uncheck the self registration option to restrict this Grafana access to the intended users only.

Edit Self Service Sign Up

So, there is no create account option here on the login page now -

Managed UI Login Page.

Cognito provides feature to use other identity provides and SSO capabilities. So, we can use those as well. We will see it in the future blog post.

Identity Providers in Cognito

Thank you for reading,

See you all in the next blog,

Best Regards,

Sankalp Sandeep Paranjpe

Excerpts from Nullcon International Security Conference Goa 2023

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:11:14 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

Excerpts from Nullcon International Security Conference Goa 2023

Created on 2023-09-26 12:15

Published on 2023-09-27 04:30

Hi everyone,

I am back with another blog - “Excerpts from Nullcon International Security Conference Goa 2023.”

So, here we start -

Attending Nullcon Goa 2023 was not merely an event on the calendar; it marked the beginning of a transformative journey through the realms of cybersecurity and technological innovation. From the moment I stepped into the vibrant atmosphere of the conference, I could sense that this experience was going to be different. This was the first time I visited Nullcon and the 2-day event was great, I got to learn so many new things.

Venue: BITS Pilani Goa Campus

BITS Pilani Goa Campus served as the venue for the Nullcon conference, providing state-of-the-art facilities, a serene environment, and a commitment to academic excellence that perfectly complemented the event's focus on cybersecurity, innovation, and collaboration.

Team MIT ADT University - with Prof. Dr. Rohit Pachlor and Prof. Deepa Mishra

We arrived at the location slightly ahead of schedule, precisely at 8:15 a.m. As soon as the registration process kicked off, we wasted no time in securing our ID cards. This early arrival not only ensured a smooth start to our day but also provided us with ample time to familiarize ourselves with the surroundings and make any last-minute preparations. It set a positive tone for the rest of the event, giving us a head start on the day's activities.

Nullcon2023

The conference began with an opening welcome note by Nullcon Co-Founder Antriksh Shah, followed by the keynote session "Multiplying threat intelligence" by John Lambert.

Opening Note and Keynote Session

Following the enlightening keynote, I ventured into the exhibition center where I had the pleasure of engaging with industry professionals. We delved into discussions about their company's products while participating in interactive quizzes and Capture The Flag (CTF) challenges, which injected an element of excitement and competition, fostering active engagement. Furthermore, in my newfound openness to exploring career opportunities, I also had the chance to discuss potential job prospects. I am now open to work, and looking for internships and full-time roles. To top it all off, I gathered some fantastic goodies like t-shirts, stickers, and more, enhancing the overall enjoyment of this enriching experience. At the booth, it was great to meet with Rahul Sasi, CloudSEK, Naman T., Mayuri Bhosle, Cyble Inc., Ann Johnson, Tesco, Swapna Sadasya, IKEA, Yeduram Vijayaraghavan, Innspark, Raman Muttreja, Payatu, Junice Liew, sqrx, Abhijit Sasane, QOS Technology

Nullcon2023

One of the most transformative aspects of Nullcon Goa was the opportunity to meet and engage with visionaries in the field. Conversations with experts who had spent years unraveling the mysteries of cybersecurity and pushing the boundaries of technology left an indelible mark on my perspective.

It was great to meet you Vandana Verma Aditya Nama Ajinkya Padghan, Ravi Mishra Divyanshu . Saide Sheikh, Akash Upadhye, Pranay Bafna Altaf Ahemad ☁️ Riddhi Shree Himanshu Giri, Gaurav Ahire, Shantanu Kulkarni Onkar Koli Shreyansh Dubey Rohan Bhange Himanshu Gupta Kaushik Ganorkar and many other people.

PS: I forgot to take pictures with many of you.

One of the panel discussions on Critical Information Infrastructure (CII) Protection: Challenges and Opportunities. In today's interconnected and digitized world, Critical Information Infrastructure (CII) protection is a paramount concern. This discussion delved into the multifaceted landscape of CII protection, highlighting the challenges and role of NCIIPC India (A unit of NTRO). Thanks to Saikat Datta, Founder and CEO of DeepStrat, Navin Kumar Singh, DG NCIIPC- Govt. Of India and all others for insights on CII protection.

Panel discussion on CII Protection

One of the technical talks I attended was Securing CI/CD Pipelines: Exploring Vulnerabilities in Workflows. In this, Siddharth Muralee explores the security aspects of CI/CD Pipelines. He addressed the difficulties in identifying vulnerabilities within CI/CD pipelines and introduced a dedicated taint-tracking tool for detecting code injection bugs in GitHub Workflows, called the Argus. Real-world examples from over 23,000 bugs discovered by the Argus tool he discussed, highlighting the importance of maintaining security in modern software development pipelines. This was a very insightful session for me, as I am trying to learn CI/CD security and DevSecOps.

Securing CI/CD Pipelines - exploring vulnerabilities in workflows by Siddharth Muralee

It was transformative to talk to Vandana Verma, Snyk, and John Lambert, Microsoft.

Thank you to Riddhi Shree for sharing her journey in the security domain and Resume clinic session. Your insights will help to improve a lot. Thank you Riyaz Walikar Sir, for guiding me about AWS Cloud Security.

Resume Clinic at Nullcon

Other technical talks -

In essence, Nullcon is more than just a conference; it's an integrated and structured platform that caters comprehensively to the needs of the IT security industry. It offered me a diverse range of events and opportunities and fosters innovation, knowledge sharing, and collaboration, ultimately contributing to the continued growth and resilience of the industry.

In conclusion, the Nullcon Goa 2023 embodied the spirit of progress and collaboration within the IT security field. It is a vital nexus where security professionals, researchers, and companies converge to shape the future of Cybersecurity.

Thank you Dr. Mohd Shafi Pathan Sir, Dr. Rohit Pachlor Sir, and Deepa Mishra Ma'am!!

Thank you MIT ADT University!

Let's connect,

https://www.linkedin.com/in/sankalp-s-paranjpe/

Sankalp Sandeep Paranjpe

Empowering Women in the Cloud: Celebrating International Women's Day @AWS UG Pune

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:11:12 +0000

Empowering Women in the Cloud: Celebrating International Women's Day @AWS UG Pune

Created on 2023-03-12 10:08

Published on 2023-03-12 10:34

I am delighted to share with the community that I attended Meet-up at AWS User Group Pune. The event was meticulously planned and showcased a distinguished panel of experts who possess extensive knowledge in the cloud technology field. This meet-up was dedicated to celebrating Women’s day and thanking women for their contribution to the domain of the Cloud. We also celebrated 10K Followers for AWS UG Pune.

First Speaker, Ridhima Kapoor Ma'am, spoke about Women in AWS Tech Communities. With a focus on inclusivity and diversity, Women in AWS Tech Communities foster an environment where women can collaborate, share knowledge, and gain hands-on experience with cutting-edge technologies. She also spoke about different AWS Community Programs.

The second Speaker, Mahima Saran Ma'am, spoke on "Getting Started in AWS Cloud for Women". She covered the basics of Cloud Computing and Different AWS Services.

The third Speaker, Bhuvaneswari Subramani Ma'am, spoke on "A Pathway to Continuous Integration/Continuous Delivery on AWS". She covered AWS Developer Services which includes CodeCommit, CodeBuild, CodePipeline and other aspects of DevOps.

Attending the AWS Community Meetup was an incredible experience. The event was filled with awesome and amazing presentations by industry experts who shared their knowledge and insights on AWS cloud computing, machine learning, and other cutting-edge technologies. The atmosphere was vibrant and inclusive, with attendees actively engaging in networking and sharing their experiences. The energy of the event was infectious, leaving me feeling inspired and motivated to further my knowledge and skills in AWS. Overall, it was an amazing opportunity to connect with like-minded professionals and learn from some of the best in the industry. Thanks to Toshal Khawale Sir, Dheeraj Choudhary Sir, Vishal Alhat ☁️, Akshay Ithape, and members of AWS User Group Pune.

Sankalp Sandeep Paranjpe

Deploying an AWS ALB with AWS WAF Protection using Terraform

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:06:07 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

Deploying an AWS ALB with AWS WAF Protection using Terraform

Created on 2025-07-22 13:13

Published on 2025-07-22 14:39

Hello everyone,

Hope you all are doing well. In today's blog we will be learning about deploying an AWS ALB with AWS WAF Protection using Terraform.

It is very important to secure your resources when you deploy them to cloud. Security is a shared responsibility model. An Application Load Balancer (ALB) helps distribute incoming traffic, while AWS WAF (Web Application Firewall) protects against common web exploits.

In this guide, we’ll build a fully automated setup using Terraform:

Create an Application Load Balancer (ALB)
Deploy an AWS WAF WebACL
Associate the WAF WebACL with the ALB

Before starting, here's some resources you should check -

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb

Also, my Github repo for the same.

https://github.com/sankalpsp07/Deploying-an-AWS-ALB-with-AWS-WAF-Protection-using-Terraform-

Let's dive in!

Let's create a provider.tf file.

Now let's create a variables.tf file.

For this blog, we will use default vpc, but in actual production scenario, we will not use use the default vpc.

We will be using terraform modules for ALB, WAF, and required security groups. Let's create folders and files for that.

Let's create a security group for ALB. In this we are specifying inbound and outbound rules.

main.tf

varibles.tf

Let's create ALB, target group, and listener with required attributes. As of now we will only create a HTTP Listener.

We can refer to https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb

variables.tf

Next step is to use command - terraform init. The command initializes a working directory containing Terraform configuration files

Next run - terraform validate. The command is used to verify the correctness of Terraform configuration files within a given directory

Next use command terraform plan to check what all resources will be created.

Next apply terraform apply -

Hence, it has created all 4 things - ALB, Listener, target groups and security group for ALB.

In AWS Management Console

Listener and Target groups also created by terraform

Now, let's create WAF Web ACL and will associate it with Load balancer -

We will be using 2 rules -

1) AWSManagedRulesCommonRuleSet

2) RateLimitRule

You can add or remove the rules as and when required. We will also define their priority.

Main.tf file for Module WAF

Main.tf file for Module WAF

Association

variables.tf file for WAF

Now again run terraform init -

Use terraform plan and terraform validate command to check what resources are getting create and validate configuration resp.

Let's now apply it.

Now, let's go to the console, and see.

Now, let's check the rules -

Now, let's check associated resources -

Hence, we deployed the AWS Application load balancer with AWS WAF Web ACL to protect it.

Now, let's clean the resources.

That's it for this blog.

Let's meet again in the next blog.

Thanks,

Regards,

Sankalp Sandeep Paranjpe

Copy of AWS Summit Bengaluru 2024 -My Experience

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:06:04 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

Copy of AWS Summit Bengaluru 2024 -My Experience

Created on 2024-05-24 04:13

Published on ---

Hello everyone,

At precisely 8:02 am, I checked into the Sheraton Grand Hotel in Whitefield. The venue was bustling with energy, filled with professionals, enthusiasts, and industry leaders all eager to explore AWS Innovations. I got my ID card and went right to the entrance.

After that with Parth Patel and Raghul Gopal our Ex-Cloud Captains, it was AWSome to visit different booths at Builders Zone and Developer Lounge. Here is my Generative AI Photograph.

My Gen AI Photograph

At the Silver Sponsor hall, I met our AWSome Community Leaders - Dheeraj Choudhary, Vishal Alhat and Sandip Das. Here’s a picture with them. We sat and had a nice chat.

Here is my picture from startup Central -

It was great to meet you - Shafraz Rahim Ridhima Kapoor Ravi Reddy Dheeraj Choudhary Vishal Alhat ☁️ Sandip Das Sridevi Murugayen Bhuvaneswari Subramani Nilesh Vaghela Jones Zachariah Noel N Avinash Dalvi Dimple Vaghela Omshree Butani Vijayaraghavan (Vijay) Vashudevan Omshree Butani Akshay Ithape Vikramadityasinh Puwar Dulari Bhushan Bhavesh Wadhwani Adit N Modi Zameer Fouzan Ayyanar Jeyakrishnan (AJ) Ranjinni Joshe ✨️ Keerthivasan Kannan Abishek Subramanian Seema Saharan Sagar Mrinal Ramya Natesan and many others, the list goes long......

The panel discussion was mind-blowing. Sandip Das, an AWS Hero, shared valuable tips on content creation. Sridevi Murugayen discussed how she balances her company responsibilities with her contributions to the AWS Community. Dheeraj Choudhary Sir, talked about building a great team and managing large community events, with a focus on local social responsibility, alongside Vishal Alhat ☁️. Bhuvaneswari Subramani, another AWS Hero, shared inspiring stories from her community journey. As an AWS Cloud Captain, this discussion was incredibly informative and will greatly influence my own community journey.

The insights and experiences shared were invaluable, and I look forward to implementing them in my future. Talks by Dimple Vaghela Mam and Jones Zachariah Noel N Sir were inspiring and informative.

Thank you,

Sankalp Sandeep Paranjpe

https://www.linkedin.com/in/sankalp-s-paranjpe/

Community Contributions: Why and How? - AWS Community Programs

Sankalp Sandeep Paranjpe — Sun, 07 Sep 2025 11:00:59 +0000

Security & Cloud Blogs by SSP Blogs related to Security and Cloud

Community Contributions: Why and How? - AWS Community Programs

Created on 2023-03-18 16:35

Published on 2023-03-19 03:30

Hi Everyone,

Today we will be talking about community contributions!

Let's get started-

First, we'll discuss "WHY?"

Community contribution is essential in any domain, as it facilitates collaboration, innovation, and knowledge sharing among experts from the industry, working professionals, and Students.

A culture of giving to each other: In a community, we learn from each other. it helps to create a culture of giving back, where we are help others.
Sharing your expertise: When people contribute to a community, they can share their knowledge and expertise with others. This helps to build a collective knowledge base that can be used by everyone in the community.
Creating a change: When people come together to contribute to a community, they can create positive change. Learn together, Grow together!!
Developing skills: Community contributions can also help individuals build skills and gain experience in non-technical skills like leadership, teamwork, and communication.
Sense of belonging: By contributing to a community, we can feel a sense of belonging and we become more connected to the people around us.

Now will talk about "HOW?"

By writing technical articles or blog posts: You can publish your knowledge on blogging websites like Medium etc.
Attending meetups: In Pune, AWS User Group Pune, Pune-Developers-Community, SecurityBoat's SB Meetup, Docker User Group, OWASP® Foundation Pune Chapter, etc other user groups and community organizes meetups every month.
Contribute to open-source projects: This can help you gain experience working with real-world code and enhance collaboration with different developers using different tech stacks.
Participate in online discussions and forums: websites like Stack Overflow, Reddit, and GitHub are great sources to start with.

Now, Comming to AWS Community Programs :

AWS Community Builders

AWS Community Builders Program is designed to support individuals who are passionate about sharing knowledge and building connections within the technical community. It provides a platform for AWS technical enthusiasts and emerging thought leaders to access technical resources, educational materials, and networking opportunities.

AWS User Groups

As the use of AWS continues to grow quickly among developers, startups, and enterprises, communities have naturally formed over 400 user groups worldwide that focus on AWS. These user groups are made up of peers who come together regularly to share ideas, provide answers to questions, and gain knowledge about new services and best practices.

AWS Heroes Program

The AWS Heroes program acknowledges a dynamic and diverse group of AWS specialists from all over the world whose eagerness to share knowledge has a genuine impact on the community. Heroes exceed expectations in sharing knowledge through a range of methods, such as social media, blog posts, open source projects, videos, and forums online; or at in-person events like conferences, workshops, and user group gatherings.

AWS Cloud Club Program

Cloud Clubs are clubs based in specific regions that cater to the needs of local students. Interested individuals can apply to become Captains of the Club's leadership team. After a thorough assessment process, they will be welcomed onto AWS Developer Slack, where they can connect with peers and enhance their skills in AWS technologies.

AWS Ambassador Partner Program

The AWS Ambassador Partner Program empowers AWS Partner employees to become technical experts in various domains by earning AWS certifications and creating publicly accessible content, such as technical write-ups, blogs, and open-source projects, that promote thought leadership. AWS Ambassadors have extensive AWS knowledge and hold multiple AWS certifications, enabling them to advocate for both AWS and their partner organization to customers.

If this post was helpful, please repost it. Also, let's connect, contribute, learn, and grow together!

Thank you!!