#008: Identity-Centric Attacks and Containment in AWS

Identity has become the primary attack surface in modern cloud environments. This episode explores how attackers abuse IAM, STS, IRSA, and trust relationships to move laterally across cloud workloads—and how to detect, contain, and respond using AWS-native services like Amazon GuardDuty, AWS CloudTrail, Amazon EventBridge, and AWS Step Functions. A deep technical dive into identity-driven defense, automated containment, and Zero Trust architecture in AWS.