/Blog
Notes on cloud security, DevSecOps, and container security, written from the inside of builds.
Software Supply Chain Security on AWS: Keyless Signing, SBOMs, and SLSA Provenance
A GitHub Actions pipeline that builds a container image, gates it on fixable CVEs, signs it with Cosign keyless, attaches SLSA provenance, and refuses to call it deployable unless all of that verifies against the exact repo that built it.
Unified Threat Detection on AWS: Security Hub, GuardDuty, and Automated EC2 Isolation
How to wire Security Hub, GuardDuty Extended Threat Detection, and a Step Functions pipeline together so a HIGH finding automatically quarantines the affected EC2 instance within seconds.
Runtime Security on EKS: Tetragon eBPF Enforcement, Falco Detection, and GuardDuty
How to stack three runtime security layers on EKS so one kills processes in-kernel, one generates a queryable alert history, and one catches what the other two miss using AWS threat intelligence.
Building an AWS Data Perimeter, Part 2: SCPs, RCPs, and Proving the Perimeter Holds
Attaching SCPs and RCPs to an AWS Organization, enforcing the new aws:VpceOrgID condition, and running denial tests against an external account with CloudTrail evidence.
Building an AWS Data Perimeter, Part 1: Design, Org Bootstrap, and Infrastructure
How to design a three-layer AWS data perimeter using SCPs, RCPs, and VPC endpoint policies, and build the substrate to validate it against an external account.
EKS Workload Identity: IRSA, OIDC Token Exchange, and When to Use Pod Identity
OIDC and IRSA for Amazon EKS: how to scope AWS access per workload without embedding credentials, and when Pod Identity is the better choice.
IAM Basics I Keep Coming Back To
IAM identity types, policy evaluation logic, and the fundamentals that matter for AWS security work.
Building Resilience Through Chaos Engineering on AWS EKS
Chaos engineering practices using Chaos Mesh on Amazon EKS to build more resilient cloud-native applications
AWS Secrets Management
AWS secrets management solution with Infrastructure as Code, cost optimization, automated rotation, and monitoring
Inspector to SSM Vulnerability Patching Automation
That simple vulnerability patching pattern everyone shows? It doesn't work when you use it.
AWS CLI Security Commands
I've used these commands to catch everything from wide-open S3 buckets to overprivileged IAM roles. Here's your practical guide to AWS security auditing that comes in handy.
Multi-Tool Container Security Scanning with AWS Integration
Building a container security scanner using Trivy, Grype, and Snyk with AWS ECR and EKS deployment automation
Implementing and Securing OWASP Juice Shop with AWS WAF
AWS security engineering project implementing OWASP Juice Shop on ECS Fargate with AWS WAF protection, Terraform IaC, real-time Athena analytics, CI/CD security pipeline, and emergency response
Secrets Management in Go Applications From Environment Variables to Vault
The irony is that Go makes building secure applications relatively straightforward, but its simplicity can be deceptive when it comes to secrets management.
Building an IaC Security Scanner in Go
As a security engineer who's implemented security controls across cloud environments, I've always been curious about how policy engines work under the hood
Monitoring Tells You It’s Broken; Observability Tells You Why
Most organizations think they have observability when they just have expensive monitoring. What is the difference and why it matters for both DevOps and security teams.
Are You Dyslexic? A Security Engineer's Late Discovery
I spent years thinking I was just 'not a good reader' until a casual conversation led to a diagnosis that explained everything. Here's how dyslexia shapes my approach to learning and career in tech.
Archive (5)
When Containers Multiply Like Rabbits and You Need a System
We solved the 'works on my machine' problem by packaging applications in containers. But success creates its own challenges. What happens when you're running not just one container, but hundreds? Or thousands?
Containers Changed Everything and I Wish I'd Started Sooner
Remember when deploying software meant crossing your fingers and hoping it would work on the production server? When 'but it works on my machine' was the most dreaded phrase in tech? Those days are fading fast, thanks to a technology that's quietly revolutionizing how we build and ship software: containers
How a Bank Fixed Their Security Nightmare With Defense in Depth
Let's takes you inside real organizations implementing Defense in Depth strategies, revealing what works, what doesn't, and what you can apply to your own cloud journey
Why One layered defense Never Works and What Does
The Defense in Depth is beautifully simple: never rely on just one defense. Instead, create multiple safeguards that work together. If one fails, others are ready to step in.
Separation of Concerns vs Least Privilege: Why They're Not the Same (and How to Use Both)
Two fundamental principles that sound similar but serve completely different purposes in cloud security. Here's why the distinction matters