#iam · 8sync News

Amazon CloudWatch now supports tags on dashboards

Amazon CloudWatch now supports tagging for dashboards, allowing teams to organize, categorize, and control access using key-value tag pairs. The PutDashboard API accepts an optional Tags parameter for up to 50 tags at creation time. Existing dashboards can be managed via TagResource, UntagResource, and ListTagsForResource APIs. Use cases include grouping dashboards by team, project, or environment, implementing attribute-based access control via IAM, and filtering dashboards in AWS Resource Explorer. The feature is available at no additional cost in all AWS regions where CloudWatch is available.

What Is Cloud Misconfiguration & How Do You Prevent It?

Cloud misconfiguration is one of the top causes of data breaches, yet remains highly preventable. Common issues include publicly exposed storage buckets, overly permissive IAM roles, unrestricted network access, disabled logging, and unencrypted data. Root causes range from insecure vendor defaults and lift-and-shift migration debt to knowledge gaps and shared responsibility confusion. Detection approaches include CSPM tools, IaC scanning (Checkov, Trivy, Terrascan), cloud-native policy services, and SIEM-integrated audit logs. Prevention focuses on defining infrastructure as code, enforcing policy as code, applying least privilege by default, provisioning from hardened landing zones, and running regular access reviews. IBM's 2025 data puts the average breach cost at $4.44M globally and $10.22M in the US.

Azure RBAC Explained: Roles, Scope, and Why Least Privilege Breaks Down

Azure RBAC uses a principal + role + scope model to control access across Azure resources. While it provides a solid foundation for access control, it does not automatically enforce least privilege — broad roles like Contributor and Owner get assigned at high scopes for convenience and are rarely revisited. Service principals and managed identities accumulate standing permissions that outlive their projects and rarely appear in access reviews. The post covers RBAC building blocks, common failure patterns (inherited access, non-human identity sprawl, overly broad roles), and best practices including narrowing scope, capping subscription Owners, using just-in-time access via Microsoft Entra PIM, and auditing dormant identities. It concludes by noting that native Azure controls reflect configured state, not actual usage, and promotes a usage-based approach to continuously enforce least privilege.