Cloud Security Architect: 2026-09-28

1. AWS IAM outbound identity federation now supports interface VPC endpoints for OIDC discovery

   AWS, 2026-09-25. Read, 2 min.

   AWS IAM outbound identity federation now supports interface VPC endpoints for the OIDC discovery APIs, so the discovery metadata and JWKS verification key endpoints can be reached through AWS PrivateLink without traffic crossing the public internet. Previously those endpoints were reachable only over the public internet, so a verifying workload in a VPC without internet access could not retrieve them.

   Why it matters for this role: Private-subnet designs that verify STS-issued JWTs can now keep JWKS retrieval on the AWS network through an interface VPC endpoint instead of a public internet path.

2. The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments

   Wiz, 2026-09-25. Read, 21 min.

   Wiz's analysis of secrets detected on infostealer-infected machines, through its integration with NordStellar, found AWS and GCP credentials made up 46% and 13% of compromised secrets, GitHub tokens roughly 10%, and AI platform credentials, led by OpenAI API keys, 5%. The post maps which cloud, code, and AI credentials infostealers target and the value attackers can derive from each.

   Why it matters for this role: Weight cloud credential exposure on developer endpoints in your threat models, since Wiz found AWS and GCP credentials were the largest share of secrets on infostealer-infected machines.

Cloud Security Architect