10 posts
A team of eight running 20 AWS accounts, critical Redshift clusters and an international expansion cannot be run purely off a ticket queue. Here's how to structure a roadmap that protects strategic work without abandoning ITSM.
Why a downstream AWS WAF rule with a correct label match statement never fires, and how managed rule groups, OverrideAction, and rule evaluation order decide where a request actually stops.
CNAPP and CSPM aren't just vendor categories. AWS split Security Hub into exactly those two products, and mapping the rest of the category onto native services shows where the stack holds up and where it doesn't.
AWS Backup started as an account-scoped service: one plan, one vault, one blast radius. Here's how cross-account copy and organisation-wide backup policies changed that, and why the isolation step still gets left out.
PCI-DSS requires encrypting east-west traffic inside your CDE (Cardholder Data Environment), not just traffic at the load balancer. Here is how to run NGINX or HAProxy as a mTLS sidecar on ECS Fargate and get certificates into the container without storing secrets in plaintext.
sslmode='require' encrypts the connection but does not verify the server certificate. Here's why that matters, and the exact configuration that actually closes the gap.
How to centralise WAF rules across 20 accounts using shared rule groups and PutPermissionPolicy when Firewall Manager is not an option.
Deleting a CloudFormation stack isn't the same as terminating its EC2 instances. Here's the failure chain that orphans instances after tenant offboarding, and the three fixes.
Cost Anomaly Detection tells you something spiked. It doesn't tell you what changed, who changed it, or who to contact. AWS FinOps Agent automates that investigation loop.
Configuring expiration on a versioned S3 bucket isn't the same as deleting objects. Here's what a complete lifecycle configuration actually looks like.