Tolu BanjiWriting on cloud security, DevSecOps, and application security by Tolu Banji.https://tolubanji.com/Software Supply Chain Security on AWS: Keyless Signing, SBOMs, and SLSA Provenancehttps://tolubanji.com/articles/aws-supply-chain-security/https://tolubanji.com/articles/aws-supply-chain-security/A GitHub Actions pipeline that builds a container image, gates it on fixable CVEs, signs it with Cosign keyless, attaches SLSA provenance, and refuses to call it deployable unless all of that verifies against the exact repo that built it.Wed, 01 Jul 2026 06:00:00 GMTcloud-securityawssecurity-engineeringdevsecopsAWSECRInspectorCosignSigstoreSLSASBOMSupply Chain SecurityGitHub ActionsContainer SecurityUnified Threat Detection on AWS: Security Hub, GuardDuty, and Automated EC2 Isolationhttps://tolubanji.com/articles/aws-unified-threat-detection/https://tolubanji.com/articles/aws-unified-threat-detection/How to wire Security Hub, GuardDuty Extended Threat Detection, and a Step Functions pipeline together so a HIGH finding automatically quarantines the affected EC2 instance within seconds.Wed, 17 Jun 2026 06:00:00 GMTcloud-securityawssecurity-engineeringdevsecopsAWSSecurity HubGuardDutyStep FunctionsEventBridgeLambdaEC2TerraformIncident ResponseCloud SecurityRuntime Security on EKS: Tetragon eBPF Enforcement, Falco Detection, and GuardDutyhttps://tolubanji.com/articles/aws-runtime-security-ebpf/https://tolubanji.com/articles/aws-runtime-security-ebpf/How to stack three runtime security layers on EKS so one kills processes in-kernel, one generates a queryable alert history, and one catches what the other two miss using AWS threat intelligence.Sun, 14 Jun 2026 16:00:00 GMTcloud-securitycontainers-orchestrationsecurity-engineeringawsEKSTetragoneBPFFalcoGuardDutyRuntime SecurityKubernetesAWSContainer SecurityIRSABuilding an AWS Data Perimeter, Part 2: SCPs, RCPs, and Proving the Perimeter Holdshttps://tolubanji.com/articles/aws-data-perimeter-part2/https://tolubanji.com/articles/aws-data-perimeter-part2/Attaching SCPs and RCPs to an AWS Organization, enforcing the new aws:VpceOrgID condition, and running denial tests against an external account with CloudTrail evidence.Mon, 01 Jun 2026 14:00:00 GMTcloud-securityawssecurity-engineeringidentity-access-managementAWSOrganizationsSCPRCPVPC EndpointS3KMSSTSData PerimeterCloudTrailCloud SecurityBuilding an AWS Data Perimeter, Part 1: Design, Org Bootstrap, and Infrastructurehttps://tolubanji.com/articles/aws-data-perimeter-part1/https://tolubanji.com/articles/aws-data-perimeter-part1/How to design a three-layer AWS data perimeter using SCPs, RCPs, and VPC endpoint policies, and build the substrate to validate it against an external account.Fri, 29 May 2026 00:00:00 GMTcloud-securityawssecurity-engineeringidentity-access-managementAWSOrganizationsSCPRCPVPC EndpointS3KMSData PerimeterCloud SecurityCloudTrailEKS Workload Identity: IRSA, OIDC Token Exchange, and When to Use Pod Identityhttps://tolubanji.com/articles/eks-oidc-irsa-deep-dive/https://tolubanji.com/articles/eks-oidc-irsa-deep-dive/OIDC and IRSA for Amazon EKS: how to scope AWS access per workload without embedding credentials, and when Pod Identity is the better choice.Mon, 11 May 2026 10:30:00 GMTcloud-securitycontainers-orchestrationidentity-access-managementawssecurity-engineeringAWSEKSKubernetesOIDCIRSAPod IdentitySecurityIAMDevSecOpsContainer SecurityIAM Basics I Keep Coming Back Tohttps://tolubanji.com/articles/aws-iam-foundations-users-roles-policies/https://tolubanji.com/articles/aws-iam-foundations-users-roles-policies/IAM identity types, policy evaluation logic, and the fundamentals that matter for AWS security work.Tue, 20 Jan 2026 11:44:00 GMTcloud-securitysecurity-engineeringawsAWSIAMSecurityRolesPoliciesExam PrepBuilding Resilience Through Chaos Engineering on AWS EKShttps://tolubanji.com/articles/chaos-engineering-eks/https://tolubanji.com/articles/chaos-engineering-eks/Chaos engineering practices using Chaos Mesh on Amazon EKS to build more resilient cloud-native applicationsThu, 15 Jan 2026 10:30:00 GMTcloud-architecturetesting-qualitycontainers-orchestrationinfrastructure-as-code-iacAWSEKSKubernetesChaos EngineeringDevOpsResilienceSite ReliabilityCloud NativeInfrastructureAWS Secrets Managementhttps://tolubanji.com/articles/aws-secrets-management-step-by-step-implementation/https://tolubanji.com/articles/aws-secrets-management-step-by-step-implementation/AWS secrets management solution with Infrastructure as Code, cost optimization, automated rotation, and monitoringWed, 10 Dec 2025 09:45:00 GMTcloud-securitysecurity-engineeringawsinfrastructure-as-code-iacsecrets-managementAWSDevSecOpsSecurityInfrastructureTerraformSecrets ManagementInspector to SSM Vulnerability Patching Automationhttps://tolubanji.com/articles/aws-vulnerability-patching-automation/https://tolubanji.com/articles/aws-vulnerability-patching-automation/That simple vulnerability patching pattern everyone shows? It doesn't work when you use it.Wed, 12 Nov 2025 10:15:00 GMTcloud-securitysecurity-engineeringawsdevsecopsAWSInspectorSSMAutomationVulnerability ManagementEventBridgeAWS CLI Security Commandshttps://tolubanji.com/articles/aws-cli-security-manual/https://tolubanji.com/articles/aws-cli-security-manual/I've used these commands to catch everything from wide-open S3 buckets to overprivileged IAM roles. Here's your practical guide to AWS security auditing that comes in handy.Wed, 08 Oct 2025 14:30:00 GMTcloud-securitysecurity-engineeringawscompliance-governanceAWS CLICloud SecurityDevSecOpsSecurity AuditIAMMulti-Tool Container Security Scanning with AWS Integrationhttps://tolubanji.com/articles/multi-tool-container-security-scanning/https://tolubanji.com/articles/multi-tool-container-security-scanning/Building a container security scanner using Trivy, Grype, and Snyk with AWS ECR and EKS deployment automationThu, 11 Sep 2025 00:00:00 GMTcloud-securitycontainers-orchestrationsecurity-engineeringdevsecopscontainer-securitydevsecopsawskubernetestrivygrypesnykImplementing and Securing OWASP Juice Shop with AWS WAFhttps://tolubanji.com/articles/aws-waf-owasp-juice-shop-security/https://tolubanji.com/articles/aws-waf-owasp-juice-shop-security/AWS security engineering project implementing OWASP Juice Shop on ECS Fargate with AWS WAF protection, Terraform IaC, real-time Athena analytics, CI/CD security pipeline, and emergency responseFri, 05 Sep 2025 15:00:00 GMTcloud-securitysecurity-engineeringawsinfrastructure-as-code-iacdevsecopssecurity-automationAWSWAFSecurityOWASPTerraformDevSecOpsInfrastructureCloudWatchAthenaCI/CDSecrets Management in Go Applications From Environment Variables to Vaulthttps://tolubanji.com/articles/secrets-management-in-go/https://tolubanji.com/articles/secrets-management-in-go/The irony is that Go makes building secure applications relatively straightforward, but its simplicity can be deceptive when it comes to secrets management.Thu, 14 Aug 2025 11:20:00 GMTsecure-codingsecurity-engineeringSecrets ManagementSecure-CodingGOBuilding an IaC Security Scanner in Gohttps://tolubanji.com/articles/policyguard/https://tolubanji.com/articles/policyguard/As a security engineer who's implemented security controls across cloud environments, I've always been curious about how policy engines work under the hoodWed, 09 Jul 2025 15:20:00 GMTinfrastructure-as-code-iacsecurity-engineeringpolicy-as-codeIacterraformOPAGOMonitoring Tells You It’s Broken; Observability Tells You Whyhttps://tolubanji.com/articles/observability-vs-monitoring/https://tolubanji.com/articles/observability-vs-monitoring/Most organizations think they have observability when they just have expensive monitoring. What is the difference and why it matters for both DevOps and security teams.Fri, 20 Sep 2024 19:45:00 GMTsecurity-engineeringdevsecopsObservabilityMonitoringDevOpsSecurity OperationsSREAre You Dyslexic? A Security Engineer's Late Discoveryhttps://tolubanji.com/articles/are-you-dyslexic/https://tolubanji.com/articles/are-you-dyslexic/I spent years thinking I was just 'not a good reader' until a casual conversation led to a diagnosis that explained everything. Here's how dyslexia shapes my approach to learning and career in tech.Sat, 13 Jul 2024 16:45:00 GMTlearning-careerDyslexiaLearningCareerTechNeurodiversityWhen Containers Multiply Like Rabbits and You Need a Systemhttps://tolubanji.com/articles/kubernetes-orchestrating-markdown/https://tolubanji.com/articles/kubernetes-orchestrating-markdown/We solved the 'works on my machine' problem by packaging applications in containers. But success creates its own challenges. What happens when you're running not just one container, but hundreds? Or thousands?Tue, 20 Feb 2024 18:00:00 GMTcontainers-orchestrationContainerizationk8ssoftware developmentContainers Changed Everything and I Wish I'd Started Soonerhttps://tolubanji.com/articles/containers-101-original-markdown/https://tolubanji.com/articles/containers-101-original-markdown/Remember when deploying software meant crossing your fingers and hoping it would work on the production server? When 'but it works on my machine' was the most dreaded phrase in tech? Those days are fading fast, thanks to a technology that's quietly revolutionizing how we build and ship software: containersThu, 15 Feb 2024 18:00:00 GMTcontainer-securitycontainers-orchestrationContainerizationContainer Enginesoftware developmentHow a Bank Fixed Their Security Nightmare With Defense in Depthhttps://tolubanji.com/articles/case-studies-markdown/https://tolubanji.com/articles/case-studies-markdown/Let's takes you inside real organizations implementing Defense in Depth strategies, revealing what works, what doesn't, and what you can apply to your own cloud journeySat, 10 Feb 2024 16:00:00 GMTcloud-securitysecurity-engineeringDefense in depthCloud SecurityAWSWhy One layered defense Never Works and What Doeshttps://tolubanji.com/articles/defense-in-depth-markdown/https://tolubanji.com/articles/defense-in-depth-markdown/The Defense in Depth is beautifully simple: never rely on just one defense. Instead, create multiple safeguards that work together. If one fails, others are ready to step in.Fri, 19 Jan 2024 16:00:00 GMTcloud-securitysecurity-engineeringDefense in depthCloud SecurityAWSSeparation of Concerns vs Least Privilege: Why They're Not the Same (and How to Use Both)https://tolubanji.com/articles/separation-vs-least-privilege/https://tolubanji.com/articles/separation-vs-least-privilege/Two fundamental principles that sound similar but serve completely different purposes in cloud security. Here's why the distinction mattersFri, 14 Jul 2023 14:30:00 GMTsecurity-engineeringcloud-securityAWSIAMSecurity ArchitectureBest Practices