10 posts · 4 references
How we introduced inspected egress across roughly 50 AWS accounts while isolating business units, production traffic, firewall recovery paths, and regulated external integrations.
Why a downstream AWS WAF rule with a correct label match statement never fires, and how managed rule groups, OverrideAction, and rule evaluation order decide where a request actually stops.
CNAPP and CSPM aren't just vendor categories. AWS split Security Hub into exactly those two products, and mapping the rest of the category onto native services shows where the stack holds up and where it doesn't.
AWS Backup started as an account-scoped service: one plan, one vault, one blast radius. Here's how cross-account copy and organisation-wide backup policies changed that, and why the isolation step still gets left out.
Fable 5 access was restored July 1, 2026. Here is what actually caused the suspension, why the capability wasn't unique to Fable 5, and the cross-vendor framework that came out of it.
PCI-DSS requires encrypting east-west traffic inside your CDE (Cardholder Data Environment), not just traffic at the load balancer. Here is how to run NGINX or HAProxy as a mTLS sidecar on ECS Fargate and get certificates into the container without storing secrets in plaintext.
Two months after the Glasswing launch, Anthropic released Claude Fable 5 for general use and upgraded the Glasswing model to Mythos 5. Here is what changed and what it means.
Anthropic and 11 major tech companies launched a collaborative AI security initiative on April 7, 2026. Here is what it is, what Claude Mythos Preview can do, and what it means for the code you ship.
sslmode='require' encrypts the connection but does not verify the server certificate. Here's why that matters, and the exact configuration that actually closes the gap.
How to centralise WAF rules across 20 accounts using shared rule groups and PutPermissionPolicy when Firewall Manager is not an option.
Deployable examples of the SRA account layout and delegated admin setup.
github #aws#security#multi-account
Distributed, centralized and combined inspection models, with the routing for each.
Config-driven multi-account baseline on top of Control Tower, aligned to compliance frameworks.
github #aws#security#multi-account
Attacker techniques mapped to cloud infrastructure. Useful for threat modelling and detection coverage reviews.