Finding risk in how resources connect
Led the ingestion and processing of AWS Config data, from S3 Parquet files into a Delta Lake, so it could be correlated across accounts.
Details
AWS Config records how each resource in an account is set up. I led the small team that built the pipeline that ingested that data, processed it, saved it to S3 as Parquet files and loaded it into a Delta Lake table, so configuration from many accounts could be analyzed together. That made correlation possible: seeing how resources and services in different accounts interact, and spotting combinations that are risky together but harmless alone, such as a public bucket, a permissive role and an exposed instance in related accounts. Security engineers identified many of these patterns and grouped related items into single findings. The data was then built and indexed downstream for later search. Part of the new AWS Security Hub: preview in 22 regions (Jun 2025), GA Dec 2025.
