The latest articles on DEV Community by Naveen Karasu (@thinkkun). https://dev.to/thinkkun https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F2911102%2Fa69591e1-4e13-492f-a849-6588a8dd2be0.png https://dev.to/thinkkun en Naveen Karasu Tue, 27 Oct 2026 02:25:58 +0000 https://dev.to/thinkkun/day-2160-practice-production-ready-api-go-backend-engineering-3noi https://dev.to/thinkkun/day-2160-practice-production-ready-api-go-backend-engineering-3noi <h1> Day 21/60: Practice: Production-ready API </h1> <p><em>60 Day Go Backend Engineering Challenge</em></p> <p>Today I focused on turning the review day into an operational checklist instead of a loose pile of disconnected tools. The strongest checkpoints were sort lessons into request flow, data flow, operations, and failure-handling buckets, rebuild only the thin spots that would hurt a real service under load or during incidents, and write down the operational signal or contract check that should have surfaced earlier.</p> <p>The mistake I wanted to avoid was calling the system understood because each individual tool looks familiar. The day felt better once the service boundary stayed visible and each component had one job.</p> <p>The goal for tomorrow is simple: keep the rule clear enough that the next service still feels related to the same design idea. I also want to keep tracing one request path end to end because it exposes weak assumptions faster than a larger demo.</p> go backend api softwareengineering Naveen Karasu Tue, 27 Oct 2026 02:25:40 +0000 https://dev.to/thinkkun/day-2160-practice-arrays-and-binary-search-javascript-dsa-57od https://dev.to/thinkkun/day-2160-practice-arrays-and-binary-search-javascript-dsa-57od <h1> Day 21/60: Practice: Arrays and binary search </h1> <p><em>60 Day DSA in JavaScript Challenge</em></p> <p>Today I focused on turning the review day into diagnosis instead of a loose pile of solved problems. The strongest checkpoints were classify misses into pattern, implementation, and time-management buckets, re-solve only representative failures instead of skimming everything again, and write down the trigger or invariant that should have surfaced earlier.</p> <p>The mistake I wanted to avoid was counting exposure as mastery and moving on before the miss is explained. The day felt better once the invariant stayed visible and each update had one job.</p> <p>The goal for tomorrow is simple: keep the rule clear enough that the next variation still feels related to the same idea. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests.</p> javascript dsa algorithms codinginterview Naveen Karasu Tue, 27 Oct 2026 02:25:22 +0000 https://dev.to/thinkkun/day-2160-practice-arrays-and-binary-search-rust-dsa-7eg https://dev.to/thinkkun/day-2160-practice-arrays-and-binary-search-rust-dsa-7eg <h1> Day 21/60: Practice: Arrays and binary search </h1> <p><em>60 Day Rust DSA Challenge</em></p> <p>Today I focused on turning the review day into diagnosis instead of a loose pile of solved problems. The strongest checkpoints were classify misses into pattern, implementation, and time-management buckets, re-solve only representative failures instead of skimming everything again, and write down the trigger or invariant that should have surfaced earlier.</p> <p>The mistake I wanted to avoid was counting exposure as mastery and moving on before the miss is explained. The day felt better once the invariant stayed visible and each update had one job.</p> <p>The goal for tomorrow is simple: keep the rule clear enough that the next variation still feels related to the same idea. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests.</p> rust dsa algorithms codinginterview Naveen Karasu Tue, 27 Oct 2026 02:25:04 +0000 https://dev.to/thinkkun/day-2175-practice-binary-search-problems-go-dsa-5013 https://dev.to/thinkkun/day-2175-practice-binary-search-problems-go-dsa-5013 <h1> Day 21/75: Practice: Binary search problems </h1> <p><em>75 Day DSA in Go Challenge</em></p> <p>Today I focused on turning the review day into diagnosis instead of a loose pile of solved problems. The strongest checkpoints were classify misses into pattern, implementation, and time-management buckets, re-solve only representative failures instead of skimming everything again, and write down the trigger or invariant that should have surfaced earlier.</p> <p>The mistake I wanted to avoid was counting exposure as mastery and moving on before the miss is explained. The day felt better once the invariant stayed visible and each update had one job.</p> <p>The goal for tomorrow is simple: keep the rule clear enough that the next variation still feels related to the same idea. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests.</p> go dsa algorithms codinginterview Naveen Karasu Tue, 27 Oct 2026 02:24:45 +0000 https://dev.to/thinkkun/day-2175-practice-binary-search-problems-c-dsa-5fab https://dev.to/thinkkun/day-2175-practice-binary-search-problems-c-dsa-5fab <h1> Day 21/75: Practice: Binary search problems </h1> <p><em>75 Day DSA in C++ Challenge</em></p> <p>Today I focused on turning the review day into diagnosis instead of a loose pile of solved problems. The strongest checkpoints were classify misses into pattern, implementation, and time-management buckets, re-solve only representative failures instead of skimming everything again, and write down the trigger or invariant that should have surfaced earlier.</p> <p>The mistake I wanted to avoid was counting exposure as mastery and moving on before the miss is explained. The day felt better once the invariant stayed visible and each update had one job.</p> <p>The goal for tomorrow is simple: keep the rule clear enough that the next variation still feels related to the same idea. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests.</p> cpp dsa algorithms codinginterview Naveen Karasu Tue, 27 Oct 2026 02:24:27 +0000 https://dev.to/thinkkun/day-2175-practice-binary-search-problems-java-dsa-4gjb https://dev.to/thinkkun/day-2175-practice-binary-search-problems-java-dsa-4gjb <h1> Day 21/75: Practice: Binary search problems </h1> <p><em>75 Day DSA in Java Challenge</em></p> <p>Today I focused on turning the review day into diagnosis instead of a loose pile of solved problems. The strongest checkpoints were classify misses into pattern, implementation, and time-management buckets, re-solve only representative failures instead of skimming everything again, and write down the trigger or invariant that should have surfaced earlier.</p> <p>The mistake I wanted to avoid was counting exposure as mastery and moving on before the miss is explained. The day felt better once the invariant stayed visible and each update had one job.</p> <p>The goal for tomorrow is simple: keep the rule clear enough that the next variation still feels related to the same idea. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests.</p> java dsa algorithms codinginterview Naveen Karasu Tue, 27 Oct 2026 02:24:09 +0000 https://dev.to/thinkkun/day-2175-practice-binary-search-problems-python-dsa-3669 https://dev.to/thinkkun/day-2175-practice-binary-search-problems-python-dsa-3669 <h1> Day 21/75: Practice: Binary search problems </h1> <p><em>75 Day DSA in Python Challenge</em></p> <p>Today I focused on turning the review day into diagnosis instead of a loose pile of solved problems. The strongest checkpoints were classify misses into pattern, implementation, and time-management buckets, re-solve only representative failures instead of skimming everything again, and write down the trigger or invariant that should have surfaced earlier.</p> <p>The mistake I wanted to avoid was counting exposure as mastery and moving on before the miss is explained. The day felt better once the invariant stayed visible and each update had one job.</p> <p>The goal for tomorrow is simple: keep the rule clear enough that the next variation still feels related to the same idea. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests. I also want to keep tracing tiny examples because they expose weak assumptions faster than large random tests.</p> python dsa algorithms codinginterview Naveen Karasu Tue, 27 Oct 2026 02:23:50 +0000 https://dev.to/thinkkun/day-21365-weekly-contestreview-dsa-system-design-3235 https://dev.to/thinkkun/day-21365-weekly-contestreview-dsa-system-design-3235 <h1> Day 21/365: Weekly Contest/Review -- DSA &amp; System Design </h1> <p><em>365 Day DSA &amp; System Design Challenge</em></p> <p>Day 21 was about making the weekly contest useful.</p> <p>What I wanted clear today:</p> <ul> <li>timed medium problems expose what actually survives pressure</li> <li>misses are often process failures, not just topic failures</li> <li>review should diagnose the miss instead of only recording the score</li> <li>the mistake log matters more than the headline result</li> <li>next week's plan should come from repeated failure patterns</li> </ul> <p>The biggest shift was treating the contest as a diagnostic. Timed practice showed where pattern recall, invariant design, and edge-case handling still break down. The review pass turned those misses into labels I can use next week.</p> <p>That made Day 21 feel much more practical than a generic review session. The score was temporary. The diagnosis was reusable.</p> <p><em>Day 21/365 of the 365 Day DSA &amp; System Design Challenge.</em></p> dsa practice algorithms interview Naveen Karasu Tue, 27 Oct 2026 02:23:32 +0000 https://dev.to/thinkkun/load-balancer-rate-limiter-lab-haproxy-stick-tables-for-connection-rate-limiting-4ijg https://dev.to/thinkkun/load-balancer-rate-limiter-lab-haproxy-stick-tables-for-connection-rate-limiting-4ijg <h2> Why Rate-Limit at the Load Balancer </h2> <p>Application-level rate limiting catches abuse after the request has already consumed backend resources -- TCP connection, TLS handshake, request parsing. HAProxy stick-tables let you shed load at the edge before any of that happens.</p> <h2> The Docker Compose Lab </h2> <div class="highlight js-code-highlight"> <pre class="highlight yaml"><code><span class="c1"># docker-compose.yml</span> <span class="na">version</span><span class="pi">:</span> <span class="s1">'</span><span class="s">3.8'</span> <span class="na">services</span><span class="pi">:</span> <span class="na">haproxy</span><span class="pi">:</span> <span class="na">image</span><span class="pi">:</span> <span class="s">haproxy:2.9</span> <span class="na">ports</span><span class="pi">:</span> <span class="pi">-</span> <span class="s2">"</span><span class="s">80:80"</span> <span class="pi">-</span> <span class="s2">"</span><span class="s">8404:8404"</span> <span class="c1"># stats</span> <span class="na">volumes</span><span class="pi">:</span> <span class="pi">-</span> <span class="s">./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro</span> <span class="na">depends_on</span><span class="pi">:</span> <span class="pi">-</span> <span class="s">backend1</span> <span class="pi">-</span> <span class="s">backend2</span> <span class="pi">-</span> <span class="s">backend3</span> <span class="na">backend1</span><span class="pi">:</span> <span class="na">build</span><span class="pi">:</span> <span class="s">./backend</span> <span class="na">environment</span><span class="pi">:</span> <span class="pi">-</span> <span class="s">BACKEND_ID=1</span> <span class="na">backend2</span><span class="pi">:</span> <span class="na">build</span><span class="pi">:</span> <span class="s">./backend</span> <span class="na">environment</span><span class="pi">:</span> <span class="pi">-</span> <span class="s">BACKEND_ID=2</span> <span class="na">backend3</span><span class="pi">:</span> <span class="na">build</span><span class="pi">:</span> <span class="s">./backend</span> <span class="na">environment</span><span class="pi">:</span> <span class="pi">-</span> <span class="s">BACKEND_ID=3</span> </code></pre> </div> <p>The backend is a minimal Go HTTP server:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight go"><code><span class="c">// backend/main.go</span> <span class="k">package</span> <span class="n">main</span> <span class="k">import</span> <span class="p">(</span> <span class="s">"fmt"</span> <span class="s">"net/http"</span> <span class="s">"os"</span> <span class="s">"time"</span> <span class="p">)</span> <span class="k">func</span> <span class="n">main</span><span class="p">()</span> <span class="p">{</span> <span class="n">id</span> <span class="o">:=</span> <span class="n">os</span><span class="o">.</span><span class="n">Getenv</span><span class="p">(</span><span class="s">"BACKEND_ID"</span><span class="p">)</span> <span class="n">http</span><span class="o">.</span><span class="n">HandleFunc</span><span class="p">(</span><span class="s">"/api/data"</span><span class="p">,</span> <span class="k">func</span><span class="p">(</span><span class="n">w</span> <span class="n">http</span><span class="o">.</span><span class="n">ResponseWriter</span><span class="p">,</span> <span class="n">r</span> <span class="o">*</span><span class="n">http</span><span class="o">.</span><span class="n">Request</span><span class="p">)</span> <span class="p">{</span> <span class="c">// Simulate 20ms of work</span> <span class="n">time</span><span class="o">.</span><span class="n">Sleep</span><span class="p">(</span><span class="m">20</span> <span class="o">*</span> <span class="n">time</span><span class="o">.</span><span class="n">Millisecond</span><span class="p">)</span> <span class="n">w</span><span class="o">.</span><span class="n">Header</span><span class="p">()</span><span class="o">.</span><span class="n">Set</span><span class="p">(</span><span class="s">"Content-Type"</span><span class="p">,</span> <span class="s">"application/json"</span><span class="p">)</span> <span class="n">fmt</span><span class="o">.</span><span class="n">Fprintf</span><span class="p">(</span><span class="n">w</span><span class="p">,</span> <span class="s">`{"backend":"%s","status":"ok"}`</span><span class="p">,</span> <span class="n">id</span><span class="p">)</span> <span class="p">})</span> <span class="n">http</span><span class="o">.</span><span class="n">HandleFunc</span><span class="p">(</span><span class="s">"/healthz"</span><span class="p">,</span> <span class="k">func</span><span class="p">(</span><span class="n">w</span> <span class="n">http</span><span class="o">.</span><span class="n">ResponseWriter</span><span class="p">,</span> <span class="n">r</span> <span class="o">*</span><span class="n">http</span><span class="o">.</span><span class="n">Request</span><span class="p">)</span> <span class="p">{</span> <span class="n">w</span><span class="o">.</span><span class="n">WriteHeader</span><span class="p">(</span><span class="m">200</span><span class="p">)</span> <span class="n">fmt</span><span class="o">.</span><span class="n">Fprint</span><span class="p">(</span><span class="n">w</span><span class="p">,</span> <span class="s">"ok"</span><span class="p">)</span> <span class="p">})</span> <span class="n">http</span><span class="o">.</span><span class="n">ListenAndServe</span><span class="p">(</span><span class="s">":8080"</span><span class="p">,</span> <span class="no">nil</span><span class="p">)</span> <span class="p">}</span> </code></pre> </div> <h2> HAProxy Config with Stick-Table Rate Limiting </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code># haproxy.cfg global log stdout format raw local0 defaults mode http log global timeout connect 5s timeout client 30s timeout server 30s option httplog frontend http_front bind *:80 # Stick-table: track request rate per source IP # 100k entries, 30s TTL, track HTTP request rate over 10s window stick-table type ip size 100k expire 30s store http_req_rate(10s) # Track the client http-request track-sc0 src # Deny if more than 50 requests in 10s (5 req/s sustained) http-request deny deny_status 429 if { sc_http_req_rate(0) gt 50 } # Add rate limit headers for observability http-response set-header X-RateLimit-Remaining %[sc0_http_req_rate(10s),sub(50)] if { sc_http_req_rate(0) gt 0 } default_backend app_servers backend app_servers balance leastconn option httpchk GET /healthz http-check expect status 200 server backend1 backend1:8080 check inter 3s fall 3 rise 2 server backend2 backend2:8080 check inter 3s fall 3 rise 2 server backend3 backend3:8080 check inter 3s fall 3 rise 2 frontend stats bind *:8404 stats enable stats uri /stats stats refresh 5s </code></pre> </div> <p>The key section is the stick-table. <code>type ip size 100k</code> creates an in-memory table keyed by source IP. <code>store http_req_rate(10s)</code> tracks a sliding window of request rates. The <code>http-request deny</code> line checks if the rate exceeds 50 requests per 10 seconds and returns 429 before the request ever reaches a backend.</p> <h2> Benchmarking with wrk </h2> <p>Start the lab and run wrk at increasing concurrency:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>docker compose up <span class="nt">-d</span> <span class="c"># Baseline: 10 concurrent connections</span> wrk <span class="nt">-t4</span> <span class="nt">-c10</span> <span class="nt">-d30s</span> http://localhost/api/data <span class="c"># Expected: all 200s, ~20ms avg latency</span> <span class="c"># Over limit: 100 concurrent connections</span> wrk <span class="nt">-t4</span> <span class="nt">-c100</span> <span class="nt">-d30s</span> http://localhost/api/data <span class="c"># Expected: mix of 200s and 429s</span> <span class="c"># Heavy load: 500 concurrent connections</span> wrk <span class="nt">-t4</span> <span class="nt">-c500</span> <span class="nt">-d30s</span> <span class="nt">-L</span> http://localhost/api/data <span class="c"># Expected: mostly 429s, but p99 latency stays low</span> <span class="c"># because HAProxy rejects before forwarding</span> </code></pre> </div> <p>The -L flag prints the full latency distribution. Compare p50, p99, and p999 across the three runs. Without stick-table rate limiting, the 500-connection test would show p99 latency climbing as backends queue requests. With it, p99 stays flat because excess requests never reach backends.</p> <h2> Checking the Stick-Table Live </h2> <p>HAProxy exposes stick-table contents via the stats socket or the stats page at :8404/stats. You can also query it from the command line:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c"># Show all tracked IPs and their request rates</span> docker compose <span class="nb">exec </span>haproxy <span class="se">\</span> socat stdio /var/run/haproxy/admin.sock <span class="o">&lt;&lt;&lt;</span> <span class="s2">"show table http_front"</span> </code></pre> </div> <p>This outputs each tracked IP with its current request rate, which is useful for debugging why a specific client is getting denied.</p> <h2> Key Differences from Application-Level Rate Limiting </h2> <ol> <li> <strong>No backend resources consumed</strong>: HAProxy denies at the connection level before proxying</li> <li> <strong>Shared state by default</strong>: one HAProxy instance sees all traffic, no Redis needed for single-LB deployments</li> <li> <strong>No Retry-After header</strong>: stick-tables do not natively calculate when the window resets, so clients get a bare 429. Add application-level rate limiting behind this for richer error responses.</li> <li> <strong>Coarser granularity</strong>: stick-tables work on IP, not on user identity or API key. Use them as the first layer, with app-level per-user limits behind them.</li> </ol> <p>This two-tier approach matches what Day 19 recommended: coarse limits at the edge, fine-grained limits in the application.</p> sre haproxy ratelimiting docker Naveen Karasu Tue, 27 Oct 2026 02:23:14 +0000 https://dev.to/thinkkun/day-2190-practice-multi-cloud-deployment-fk https://dev.to/thinkkun/day-2190-practice-multi-cloud-deployment-fk <h1> Day 21/90: Practice: Multi-cloud deployment </h1> <p><em>90 Day Security Infrastructure Challenge</em></p> <p>I am writing this one as if a teammate opened the pull request and asked what actually matters. My answer is that combining modules, configuration management, policy checks, and rollout steps into one delivery system a team can actually maintain. Good infrastructure content should make the operational boundary visible, not bury it behind screenshots or one happy-path command.</p> <h2> The Copy-Paste Multi-Cloud Problem </h2> <p>The practical reason to spend time on the copy-paste multi-cloud problem is simple: it is one of the places where infrastructure drift hides behind a clean-looking diff. Combining modules, configuration management, policy checks, and rollout steps into one delivery system a team can actually maintain.</p> <p>The repo earns trust when module outputs, pipeline logs, state backends, deployment runbooks, change approvals, and restore steps kept together tell the same story as the PR summary. That is how you get to a production-ready infrastructure pipeline with clear ownership, promotion stages, and recovery notes for every major component. Project days only count if the repo is reviewable by someone who did not build it and still needs to operate it next quarter.<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>terraform show <span class="nt">-json</span> practice_multi_cloud_deploym.tfplan <span class="o">&gt;</span> artifacts/practice_multi_cloud_deploym.json checkov <span class="nt">-d</span> terraform/ conftest <span class="nb">test </span>artifacts/practice_multi_cloud_deploym.json <span class="nt">--policy</span> policies/ <span class="nb">echo</span> <span class="s2">"rollback owner for practice: multi-cloud deployment: platform-oncall"</span> <span class="o">&gt;&gt;</span> runbooks/practice_multi_cloud_deploym.md </code></pre> </div> <h2> Shared Module Interface </h2> <p>Shared Module Interface sounds narrow until it fails under pressure. Then you find out whether the infrastructure repo can explain its own behavior. The real work is still combining modules, configuration management, policy checks, and rollout steps into one delivery system a team can actually maintain.</p> <p>I do not want a magical success message. I want module outputs, pipeline logs, state backends, deployment runbooks, change approvals, and restore steps kept together, because that evidence is what turns the work into a production-ready infrastructure pipeline with clear ownership, promotion stages, and recovery notes for every major component. Project days only count if the repo is reviewable by someone who did not build it and still needs to operate it next quarter.</p> <h2> Cloud-Specific Implementations with Baked-In Defaults </h2> <p>Cloud-Specific Implementations with Baked-In Defaults is where practice: multi-cloud deployment becomes operational. On a real team, the argument is rarely about syntax. It is about combining modules, configuration management, policy checks, and rollout steps into one delivery system a team can actually maintain.</p> <p>What I want back from this day is a production-ready infrastructure pipeline with clear ownership, promotion stages, and recovery notes for every major component. That only happens when the change leaves evidence in module outputs, pipeline logs, state backends, deployment runbooks, change approvals, and restore steps kept together. Project days only count if the repo is reviewable by someone who did not build it and still needs to operate it next quarter.</p> <h2> Review posture </h2> <ul> <li>I want the pull request to name the affected environment, the rollback path, and the state or inventory boundary touched by practice: multi-cloud deployment.</li> <li>The review should show exactly how the copy-paste multi-cloud problem changes behavior, not just that the file format is valid.</li> <li>If a pipeline gate, policy check, or drift report disagrees with the proposed change, that disagreement belongs in the review thread instead of hidden in logs.</li> </ul> <p>The outcome I care about is a production-ready infrastructure pipeline with clear ownership, promotion stages, and recovery notes for every major component. That is only believable when module outputs, pipeline logs, state backends, deployment runbooks, change approvals, and restore steps kept together are easy to find and consistent with the explanation in the pull request. Project days only count if the repo is reviewable by someone who did not build it and still needs to operate it next quarter.</p> <h2> Why this belongs in a security infrastructure track </h2> <p>IaC, Ansible, policy as code, GitOps, and infrastructure testing all share the same responsibility: make change review safer than console drift. That is why I keep bringing the lesson back to Terraform, IaC boundaries, pipeline evidence, and the operational story behind the diff.</p> terraform ansible devsecops security Naveen Karasu Tue, 27 Oct 2026 02:22:56 +0000 https://dev.to/thinkkun/automating-owasp-top-10-detection-with-python-and-burp-24k9 https://dev.to/thinkkun/automating-owasp-top-10-detection-with-python-and-burp-24k9 <h1> Automating OWASP Top 10 Detection with Python and Burp </h1> <p><em>Day 21/60 -- Penetration Testing Challenge</em></p> <p>Manual testing is necessary, but automating the repetitive parts of OWASP Top 10 testing saves hours on every engagement. Today I built a few scripts during my lab marathon that I want to share.</p> <h2> Automated SQLi Detection Script </h2> <p>Before pulling out sqlmap, I run a quick detection script to confirm injection points and determine the injection type:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight python"><code><span class="kn">import</span> <span class="n">requests</span> <span class="kn">import</span> <span class="n">time</span> <span class="kn">import</span> <span class="n">sys</span> <span class="k">def</span> <span class="nf">detect_sqli</span><span class="p">(</span><span class="n">url</span><span class="p">,</span> <span class="n">param</span><span class="p">,</span> <span class="n">session_cookies</span><span class="o">=</span><span class="bp">None</span><span class="p">):</span> <span class="n">s</span> <span class="o">=</span> <span class="n">requests</span><span class="p">.</span><span class="nc">Session</span><span class="p">()</span> <span class="k">if</span> <span class="n">session_cookies</span><span class="p">:</span> <span class="n">s</span><span class="p">.</span><span class="n">cookies</span><span class="p">.</span><span class="nf">update</span><span class="p">(</span><span class="n">session_cookies</span><span class="p">)</span> <span class="n">baseline</span> <span class="o">=</span> <span class="n">s</span><span class="p">.</span><span class="nf">get</span><span class="p">(</span><span class="n">url</span><span class="p">,</span> <span class="n">params</span><span class="o">=</span><span class="p">{</span><span class="n">param</span><span class="p">:</span> <span class="sh">'</span><span class="s">1</span><span class="sh">'</span><span class="p">}).</span><span class="n">text</span> <span class="n">baseline_len</span> <span class="o">=</span> <span class="nf">len</span><span class="p">(</span><span class="n">baseline</span><span class="p">)</span> <span class="n">tests</span> <span class="o">=</span> <span class="p">{</span> <span class="sh">'</span><span class="s">error</span><span class="sh">'</span><span class="p">:</span> <span class="sh">"</span><span class="s">1</span><span class="sh">'"</span><span class="p">,</span> <span class="sh">'</span><span class="s">bool_true</span><span class="sh">'</span><span class="p">:</span> <span class="sh">'</span><span class="s">1 AND 1=1</span><span class="sh">'</span><span class="p">,</span> <span class="sh">'</span><span class="s">bool_false</span><span class="sh">'</span><span class="p">:</span> <span class="sh">'</span><span class="s">1 AND 1=2</span><span class="sh">'</span><span class="p">,</span> <span class="sh">'</span><span class="s">time_mysql</span><span class="sh">'</span><span class="p">:</span> <span class="sh">"</span><span class="s">1</span><span class="sh">'</span><span class="s"> AND SLEEP(3)-- </span><span class="sh">"</span><span class="p">,</span> <span class="sh">'</span><span class="s">time_mssql</span><span class="sh">'</span><span class="p">:</span> <span class="sh">"</span><span class="s">1</span><span class="sh">'</span><span class="s">; WAITFOR DELAY </span><span class="sh">'</span><span class="s">0:0:3</span><span class="sh">'</span><span class="s">--</span><span class="sh">"</span><span class="p">,</span> <span class="p">}</span> <span class="n">results</span> <span class="o">=</span> <span class="p">{}</span> <span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="n">payload</span> <span class="ow">in</span> <span class="n">tests</span><span class="p">.</span><span class="nf">items</span><span class="p">():</span> <span class="n">start</span> <span class="o">=</span> <span class="n">time</span><span class="p">.</span><span class="nf">time</span><span class="p">()</span> <span class="n">resp</span> <span class="o">=</span> <span class="n">s</span><span class="p">.</span><span class="nf">get</span><span class="p">(</span><span class="n">url</span><span class="p">,</span> <span class="n">params</span><span class="o">=</span><span class="p">{</span><span class="n">param</span><span class="p">:</span> <span class="n">payload</span><span class="p">})</span> <span class="n">elapsed</span> <span class="o">=</span> <span class="n">time</span><span class="p">.</span><span class="nf">time</span><span class="p">()</span> <span class="o">-</span> <span class="n">start</span> <span class="n">diff</span> <span class="o">=</span> <span class="nf">abs</span><span class="p">(</span><span class="nf">len</span><span class="p">(</span><span class="n">resp</span><span class="p">.</span><span class="n">text</span><span class="p">)</span> <span class="o">-</span> <span class="n">baseline_len</span><span class="p">)</span> <span class="k">if</span> <span class="sh">'</span><span class="s">time</span><span class="sh">'</span> <span class="ow">in</span> <span class="n">name</span> <span class="ow">and</span> <span class="n">elapsed</span> <span class="o">&gt;</span> <span class="mf">2.5</span><span class="p">:</span> <span class="n">results</span><span class="p">[</span><span class="n">name</span><span class="p">]</span> <span class="o">=</span> <span class="sa">f</span><span class="sh">'</span><span class="s">LIKELY (delay=</span><span class="si">{</span><span class="n">elapsed</span><span class="si">:</span><span class="p">.</span><span class="mi">1</span><span class="n">f</span><span class="si">}</span><span class="s">s)</span><span class="sh">'</span> <span class="k">elif</span> <span class="n">name</span> <span class="o">==</span> <span class="sh">'</span><span class="s">error</span><span class="sh">'</span> <span class="ow">and</span> <span class="p">(</span><span class="sh">'</span><span class="s">error</span><span class="sh">'</span> <span class="ow">in</span> <span class="n">resp</span><span class="p">.</span><span class="n">text</span><span class="p">.</span><span class="nf">lower</span><span class="p">()</span> <span class="ow">or</span> <span class="sh">'</span><span class="s">sql</span><span class="sh">'</span> <span class="ow">in</span> <span class="n">resp</span><span class="p">.</span><span class="n">text</span><span class="p">.</span><span class="nf">lower</span><span class="p">()):</span> <span class="n">results</span><span class="p">[</span><span class="n">name</span><span class="p">]</span> <span class="o">=</span> <span class="sa">f</span><span class="sh">'</span><span class="s">ERROR DETECTED (len_diff=</span><span class="si">{</span><span class="n">diff</span><span class="si">}</span><span class="s">)</span><span class="sh">'</span> <span class="k">elif</span> <span class="n">name</span> <span class="o">==</span> <span class="sh">'</span><span class="s">bool_true</span><span class="sh">'</span> <span class="ow">and</span> <span class="n">diff</span> <span class="o">&lt;</span> <span class="mi">50</span><span class="p">:</span> <span class="n">results</span><span class="p">[</span><span class="sh">'</span><span class="s">bool_true</span><span class="sh">'</span><span class="p">]</span> <span class="o">=</span> <span class="sa">f</span><span class="sh">'</span><span class="s">Same as baseline (diff=</span><span class="si">{</span><span class="n">diff</span><span class="si">}</span><span class="s">)</span><span class="sh">'</span> <span class="k">elif</span> <span class="n">name</span> <span class="o">==</span> <span class="sh">'</span><span class="s">bool_false</span><span class="sh">'</span> <span class="ow">and</span> <span class="n">diff</span> <span class="o">&gt;</span> <span class="mi">100</span><span class="p">:</span> <span class="n">results</span><span class="p">[</span><span class="sh">'</span><span class="s">bool_false</span><span class="sh">'</span><span class="p">]</span> <span class="o">=</span> <span class="sa">f</span><span class="sh">'</span><span class="s">DIFFERENT from baseline (diff=</span><span class="si">{</span><span class="n">diff</span><span class="si">}</span><span class="s">)</span><span class="sh">'</span> <span class="k">else</span><span class="p">:</span> <span class="n">results</span><span class="p">[</span><span class="n">name</span><span class="p">]</span> <span class="o">=</span> <span class="sa">f</span><span class="sh">'</span><span class="s">No indicator (diff=</span><span class="si">{</span><span class="n">diff</span><span class="si">}</span><span class="s">, time=</span><span class="si">{</span><span class="n">elapsed</span><span class="si">:</span><span class="p">.</span><span class="mi">1</span><span class="n">f</span><span class="si">}</span><span class="s">s)</span><span class="sh">'</span> <span class="k">return</span> <span class="n">results</span> <span class="k">if</span> <span class="n">__name__</span> <span class="o">==</span> <span class="sh">'</span><span class="s">__main__</span><span class="sh">'</span><span class="p">:</span> <span class="n">url</span> <span class="o">=</span> <span class="n">sys</span><span class="p">.</span><span class="n">argv</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span> <span class="k">if</span> <span class="nf">len</span><span class="p">(</span><span class="n">sys</span><span class="p">.</span><span class="n">argv</span><span class="p">)</span> <span class="o">&gt;</span> <span class="mi">1</span> <span class="k">else</span> <span class="sh">'</span><span class="s">http://localhost/dvwa/vulnerabilities/sqli/</span><span class="sh">'</span> <span class="k">for</span> <span class="n">test</span><span class="p">,</span> <span class="n">result</span> <span class="ow">in</span> <span class="nf">detect_sqli</span><span class="p">(</span><span class="n">url</span><span class="p">,</span> <span class="sh">'</span><span class="s">id</span><span class="sh">'</span><span class="p">,</span> <span class="p">{</span><span class="sh">'</span><span class="s">security</span><span class="sh">'</span><span class="p">:</span> <span class="sh">'</span><span class="s">low</span><span class="sh">'</span><span class="p">}).</span><span class="nf">items</span><span class="p">():</span> <span class="nf">print</span><span class="p">(</span><span class="sa">f</span><span class="sh">'</span><span class="s"> </span><span class="si">{</span><span class="n">test</span><span class="si">}</span><span class="s">: </span><span class="si">{</span><span class="n">result</span><span class="si">}</span><span class="sh">'</span><span class="p">)</span> </code></pre> </div> <p>This gives you a quick read on which injection types are viable before you commit time to extraction.</p> <h2> XSS Context Analyzer </h2> <p>Instead of throwing payloads blindly, figure out where your input lands:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight python"><code><span class="kn">import</span> <span class="n">requests</span> <span class="kn">from</span> <span class="n">html.parser</span> <span class="kn">import</span> <span class="n">HTMLParser</span> <span class="k">def</span> <span class="nf">find_reflection_context</span><span class="p">(</span><span class="n">url</span><span class="p">,</span> <span class="n">param</span><span class="p">,</span> <span class="n">canary</span><span class="o">=</span><span class="sh">'</span><span class="s">XSS_CANARY_7291</span><span class="sh">'</span><span class="p">):</span> <span class="n">resp</span> <span class="o">=</span> <span class="n">requests</span><span class="p">.</span><span class="nf">get</span><span class="p">(</span><span class="n">url</span><span class="p">,</span> <span class="n">params</span><span class="o">=</span><span class="p">{</span><span class="n">param</span><span class="p">:</span> <span class="n">canary</span><span class="p">})</span> <span class="n">body</span> <span class="o">=</span> <span class="n">resp</span><span class="p">.</span><span class="n">text</span> <span class="n">contexts</span> <span class="o">=</span> <span class="p">[]</span> <span class="n">idx</span> <span class="o">=</span> <span class="mi">0</span> <span class="k">while</span> <span class="bp">True</span><span class="p">:</span> <span class="n">pos</span> <span class="o">=</span> <span class="n">body</span><span class="p">.</span><span class="nf">find</span><span class="p">(</span><span class="n">canary</span><span class="p">,</span> <span class="n">idx</span><span class="p">)</span> <span class="k">if</span> <span class="n">pos</span> <span class="o">==</span> <span class="o">-</span><span class="mi">1</span><span class="p">:</span> <span class="k">break</span> <span class="n">before</span> <span class="o">=</span> <span class="n">body</span><span class="p">[</span><span class="nf">max</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">pos</span><span class="o">-</span><span class="mi">200</span><span class="p">):</span><span class="n">pos</span><span class="p">]</span> <span class="k">if</span> <span class="sh">'</span><span class="s">&lt;script</span><span class="sh">'</span> <span class="ow">in</span> <span class="n">before</span><span class="p">.</span><span class="nf">rsplit</span><span class="p">(</span><span class="sh">'</span><span class="s">&lt;</span><span class="sh">'</span><span class="p">,</span> <span class="mi">1</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">:][</span><span class="mi">0</span><span class="p">]</span> <span class="k">if</span> <span class="sh">'</span><span class="s">&lt;</span><span class="sh">'</span> <span class="ow">in</span> <span class="n">before</span> <span class="k">else</span> <span class="sh">''</span><span class="p">:</span> <span class="n">contexts</span><span class="p">.</span><span class="nf">append</span><span class="p">((</span><span class="sh">'</span><span class="s">javascript_string</span><span class="sh">'</span><span class="p">,</span> <span class="n">pos</span><span class="p">))</span> <span class="k">elif</span> <span class="n">before</span><span class="p">.</span><span class="nf">rstrip</span><span class="p">().</span><span class="nf">endswith</span><span class="p">(</span><span class="sh">'</span><span class="s">=</span><span class="sh">'</span><span class="p">):</span> <span class="n">contexts</span><span class="p">.</span><span class="nf">append</span><span class="p">((</span><span class="sh">'</span><span class="s">attribute_value_unquoted</span><span class="sh">'</span><span class="p">,</span> <span class="n">pos</span><span class="p">))</span> <span class="k">elif</span> <span class="n">before</span><span class="p">.</span><span class="nf">rstrip</span><span class="p">().</span><span class="nf">endswith</span><span class="p">(</span><span class="sh">'"'</span><span class="p">):</span> <span class="n">contexts</span><span class="p">.</span><span class="nf">append</span><span class="p">((</span><span class="sh">'</span><span class="s">attribute_value_doublequoted</span><span class="sh">'</span><span class="p">,</span> <span class="n">pos</span><span class="p">))</span> <span class="k">elif</span> <span class="n">before</span><span class="p">.</span><span class="nf">rstrip</span><span class="p">().</span><span class="nf">endswith</span><span class="p">(</span><span class="sh">"'"</span><span class="p">):</span> <span class="n">contexts</span><span class="p">.</span><span class="nf">append</span><span class="p">((</span><span class="sh">'</span><span class="s">attribute_value_singlequoted</span><span class="sh">'</span><span class="p">,</span> <span class="n">pos</span><span class="p">))</span> <span class="k">else</span><span class="p">:</span> <span class="n">contexts</span><span class="p">.</span><span class="nf">append</span><span class="p">((</span><span class="sh">'</span><span class="s">html_body</span><span class="sh">'</span><span class="p">,</span> <span class="n">pos</span><span class="p">))</span> <span class="n">idx</span> <span class="o">=</span> <span class="n">pos</span> <span class="o">+</span> <span class="nf">len</span><span class="p">(</span><span class="n">canary</span><span class="p">)</span> <span class="k">return</span> <span class="n">contexts</span> <span class="n">results</span> <span class="o">=</span> <span class="nf">find_reflection_context</span><span class="p">(</span><span class="sh">'</span><span class="s">http://localhost/dvwa/vulnerabilities/xss_r/</span><span class="sh">'</span><span class="p">,</span> <span class="sh">'</span><span class="s">name</span><span class="sh">'</span><span class="p">)</span> <span class="k">for</span> <span class="n">ctx</span><span class="p">,</span> <span class="n">pos</span> <span class="ow">in</span> <span class="n">results</span><span class="p">:</span> <span class="nf">print</span><span class="p">(</span><span class="sa">f</span><span class="sh">'</span><span class="s"> Reflected at position </span><span class="si">{</span><span class="n">pos</span><span class="si">}</span><span class="s">: context=</span><span class="si">{</span><span class="n">ctx</span><span class="si">}</span><span class="sh">'</span><span class="p">)</span> </code></pre> </div> <p>Knowing the context tells you exactly which payload class to use. No guessing, no wasted attempts.</p> <h2> SSRF Port Scanner </h2> <p>When you find an SSRF, use it to map internal services:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight python"><code><span class="kn">import</span> <span class="n">requests</span> <span class="kn">import</span> <span class="n">concurrent.futures</span> <span class="k">def</span> <span class="nf">ssrf_port_scan</span><span class="p">(</span><span class="n">vuln_url</span><span class="p">,</span> <span class="n">param</span><span class="p">,</span> <span class="n">internal_host</span><span class="o">=</span><span class="sh">'</span><span class="s">127.0.0.1</span><span class="sh">'</span><span class="p">,</span> <span class="n">ports</span><span class="o">=</span><span class="bp">None</span><span class="p">):</span> <span class="k">if</span> <span class="n">ports</span> <span class="ow">is</span> <span class="bp">None</span><span class="p">:</span> <span class="n">ports</span> <span class="o">=</span> <span class="p">[</span><span class="mi">22</span><span class="p">,</span> <span class="mi">80</span><span class="p">,</span> <span class="mi">443</span><span class="p">,</span> <span class="mi">3306</span><span class="p">,</span> <span class="mi">5432</span><span class="p">,</span> <span class="mi">6379</span><span class="p">,</span> <span class="mi">8080</span><span class="p">,</span> <span class="mi">8443</span><span class="p">,</span> <span class="mi">9200</span><span class="p">,</span> <span class="mi">27017</span><span class="p">]</span> <span class="n">open_ports</span> <span class="o">=</span> <span class="p">[]</span> <span class="k">def</span> <span class="nf">check_port</span><span class="p">(</span><span class="n">port</span><span class="p">):</span> <span class="n">ssrf_target</span> <span class="o">=</span> <span class="sa">f</span><span class="sh">'</span><span class="s">http://</span><span class="si">{</span><span class="n">internal_host</span><span class="si">}</span><span class="s">:</span><span class="si">{</span><span class="n">port</span><span class="si">}</span><span class="s">/</span><span class="sh">'</span> <span class="k">try</span><span class="p">:</span> <span class="n">resp</span> <span class="o">=</span> <span class="n">requests</span><span class="p">.</span><span class="nf">post</span><span class="p">(</span><span class="n">vuln_url</span><span class="p">,</span> <span class="n">data</span><span class="o">=</span><span class="p">{</span><span class="n">param</span><span class="p">:</span> <span class="n">ssrf_target</span><span class="p">},</span> <span class="n">timeout</span><span class="o">=</span><span class="mi">5</span><span class="p">)</span> <span class="k">if</span> <span class="nf">len</span><span class="p">(</span><span class="n">resp</span><span class="p">.</span><span class="n">text</span><span class="p">)</span> <span class="o">&gt;</span> <span class="mi">100</span> <span class="ow">and</span> <span class="n">resp</span><span class="p">.</span><span class="n">status_code</span> <span class="o">==</span> <span class="mi">200</span><span class="p">:</span> <span class="k">return</span> <span class="n">port</span><span class="p">,</span> <span class="nf">len</span><span class="p">(</span><span class="n">resp</span><span class="p">.</span><span class="n">text</span><span class="p">)</span> <span class="k">except</span> <span class="n">requests</span><span class="p">.</span><span class="n">Timeout</span><span class="p">:</span> <span class="k">return</span> <span class="n">port</span><span class="p">,</span> <span class="sh">'</span><span class="s">timeout (possibly open)</span><span class="sh">'</span> <span class="k">return</span> <span class="bp">None</span> <span class="k">with</span> <span class="n">concurrent</span><span class="p">.</span><span class="n">futures</span><span class="p">.</span><span class="nc">ThreadPoolExecutor</span><span class="p">(</span><span class="n">max_workers</span><span class="o">=</span><span class="mi">5</span><span class="p">)</span> <span class="k">as</span> <span class="n">pool</span><span class="p">:</span> <span class="n">futures</span> <span class="o">=</span> <span class="p">{</span><span class="n">pool</span><span class="p">.</span><span class="nf">submit</span><span class="p">(</span><span class="n">check_port</span><span class="p">,</span> <span class="n">p</span><span class="p">):</span> <span class="n">p</span> <span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="n">ports</span><span class="p">}</span> <span class="k">for</span> <span class="n">future</span> <span class="ow">in</span> <span class="n">concurrent</span><span class="p">.</span><span class="n">futures</span><span class="p">.</span><span class="nf">as_completed</span><span class="p">(</span><span class="n">futures</span><span class="p">):</span> <span class="n">result</span> <span class="o">=</span> <span class="n">future</span><span class="p">.</span><span class="nf">result</span><span class="p">()</span> <span class="k">if</span> <span class="n">result</span><span class="p">:</span> <span class="n">open_ports</span><span class="p">.</span><span class="nf">append</span><span class="p">(</span><span class="n">result</span><span class="p">)</span> <span class="nf">print</span><span class="p">(</span><span class="sa">f</span><span class="sh">'</span><span class="s"> Port </span><span class="si">{</span><span class="n">result</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="si">}</span><span class="s">: response_length=</span><span class="si">{</span><span class="n">result</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span><span class="si">}</span><span class="sh">'</span><span class="p">)</span> <span class="k">return</span> <span class="n">open_ports</span> </code></pre> </div> <p>This turns a single SSRF into a full internal port map. On AWS instances, always add 169.254.169.254 port 80 to the list for metadata.</p> <h2> Key Takeaways </h2> <p>Automation does not replace manual testing, but it handles the repetitive detection phase so you can spend your time on the creative exploitation work. These scripts are starting points -- adapt them for each engagement.</p> <p><em>Day 21/60 of the 60 Day Penetration Testing Challenge</em></p> security python webdev tutorial Naveen Karasu Tue, 27 Oct 2026 02:22:37 +0000 https://dev.to/thinkkun/aws-security-hardening-checklist-the-practical-version-30lk https://dev.to/thinkkun/aws-security-hardening-checklist-the-practical-version-30lk <h1> Day 21: AWS Security Hardening Practice </h1> <p>Here's the hardening script I run on every new AWS account. It catches the misconfigurations that show up in 90% of security audits.</p> <h2> Audit IAM Users for Console Access Without MFA </h2> <p>Before touching infrastructure, check identity:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>aws iam generate-credential-report <span class="o">&gt;</span> /dev/null 2&gt;&amp;1 <span class="nb">sleep </span>5 aws iam get-credential-report <span class="nt">--query</span> <span class="s1">'Content'</span> <span class="nt">--output</span> text | <span class="se">\</span> <span class="nb">base64</span> <span class="nt">-d</span> | <span class="se">\</span> <span class="nb">awk</span> <span class="nt">-F</span><span class="s1">','</span> <span class="s1">'NR&gt;1 &amp;&amp; $4=="true" &amp;&amp; $8=="false" {print "NO MFA:", $1}'</span> </code></pre> </div> <p>This pulls the credential report and finds every IAM user who has console access but no MFA enabled. These accounts are one phished password away from full compromise.</p> <h2> Detect Unused Access Keys </h2> <p>Access keys that haven't been used in 90+ days are a liability:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight python"><code><span class="kn">import</span> <span class="n">boto3</span> <span class="kn">from</span> <span class="n">datetime</span> <span class="kn">import</span> <span class="n">datetime</span><span class="p">,</span> <span class="n">timezone</span><span class="p">,</span> <span class="n">timedelta</span> <span class="n">iam</span> <span class="o">=</span> <span class="n">boto3</span><span class="p">.</span><span class="nf">client</span><span class="p">(</span><span class="sh">'</span><span class="s">iam</span><span class="sh">'</span><span class="p">)</span> <span class="n">threshold</span> <span class="o">=</span> <span class="n">datetime</span><span class="p">.</span><span class="nf">now</span><span class="p">(</span><span class="n">timezone</span><span class="p">.</span><span class="n">utc</span><span class="p">)</span> <span class="o">-</span> <span class="nf">timedelta</span><span class="p">(</span><span class="n">days</span><span class="o">=</span><span class="mi">90</span><span class="p">)</span> <span class="k">for</span> <span class="n">user</span> <span class="ow">in</span> <span class="n">iam</span><span class="p">.</span><span class="nf">list_users</span><span class="p">()[</span><span class="sh">'</span><span class="s">Users</span><span class="sh">'</span><span class="p">]:</span> <span class="n">keys</span> <span class="o">=</span> <span class="n">iam</span><span class="p">.</span><span class="nf">list_access_keys</span><span class="p">(</span><span class="n">UserName</span><span class="o">=</span><span class="n">user</span><span class="p">[</span><span class="sh">'</span><span class="s">UserName</span><span class="sh">'</span><span class="p">])[</span><span class="sh">'</span><span class="s">AccessKeyMetadata</span><span class="sh">'</span><span class="p">]</span> <span class="k">for</span> <span class="n">key</span> <span class="ow">in</span> <span class="n">keys</span><span class="p">:</span> <span class="k">if</span> <span class="n">key</span><span class="p">[</span><span class="sh">'</span><span class="s">Status</span><span class="sh">'</span><span class="p">]</span> <span class="o">==</span> <span class="sh">'</span><span class="s">Active</span><span class="sh">'</span><span class="p">:</span> <span class="n">last_used</span> <span class="o">=</span> <span class="n">iam</span><span class="p">.</span><span class="nf">get_access_key_last_used</span><span class="p">(</span> <span class="n">AccessKeyId</span><span class="o">=</span><span class="n">key</span><span class="p">[</span><span class="sh">'</span><span class="s">AccessKeyId</span><span class="sh">'</span><span class="p">]</span> <span class="p">)[</span><span class="sh">'</span><span class="s">AccessKeyLastUsed</span><span class="sh">'</span><span class="p">]</span> <span class="n">used_date</span> <span class="o">=</span> <span class="n">last_used</span><span class="p">.</span><span class="nf">get</span><span class="p">(</span><span class="sh">'</span><span class="s">LastUsedDate</span><span class="sh">'</span><span class="p">)</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">used_date</span> <span class="ow">or</span> <span class="n">used_date</span> <span class="o">&lt;</span> <span class="n">threshold</span><span class="p">:</span> <span class="nf">print</span><span class="p">(</span><span class="sa">f</span><span class="sh">"</span><span class="s">STALE: </span><span class="si">{</span><span class="n">user</span><span class="p">[</span><span class="sh">'</span><span class="s">UserName</span><span class="sh">'</span><span class="p">]</span><span class="si">}</span><span class="s"> - </span><span class="si">{</span><span class="n">key</span><span class="p">[</span><span class="sh">'</span><span class="s">AccessKeyId</span><span class="sh">'</span><span class="p">]</span><span class="si">}</span><span class="sh">"</span><span class="p">)</span> </code></pre> </div> <p>Deactivate stale keys immediately. If nobody complains within a week, delete them.</p> <p>These two checks plus the S3 and IMDSv2 hardening from the full post cover the top four AWS attack vectors.</p> aws security cloud devops