A 403 you can't fix in IAM
A GitLab to AWS OIDC trust policy kept returning 403, and no IAM change fixed it: the policy matched a claim GitLab never actually asserts.
Categories
24 pages
infrastructure
The reusable AWS building blocks I lean on, all public: Terraform modules and tooling for bootstrapping an account, enforcing a security baseline and managing KMS-backed signing keys. Built for my own use, and yours.
Routing security findings without the noise
Routing AWS GuardDuty and Security Hub findings so an alert still means something: forward high severity only, and drop the duplicates.
Why go-tool-base left GitHub for GitLab
An accidental major version bump was the last straw after months of unreliability. Why a Go framework moved off GitHub, and what moved with it.
Why I hand-rolled every module
Why security-critical infrastructure got raw resources rather than community wrapper modules, and what that actually cost in lines and in review.
Hardening the account that will hold the keys
Applying a security baseline to a fresh AWS account: audit logging, config recording, threat detection and an operator role that is not root.
No access keys in CI
Replacing long-lived AWS access keys in CI with OIDC federation, so the pipeline mints a short-lived token instead of holding a secret.
Two layers of tags, and which one wins
AWS tagging in two layers: account-wide invariants on the provider default tags, resource specifics in the module, and which one wins on a clash.
The chicken-and-egg of remote state
The bootstrap stack has to create the bucket its own state lives in. Applying once with a local backend, then migrating the state into it.
The cleanup tool that almost deleted its own hands
Reading an aws-nuke dry run: the screenfuls of red are harmless noise, and the real hazard is one quiet line in the middle of them.
The security finding you must not fix
A checkov finding you must suppress rather than fix: that KMS policy statement is the escape hatch that stops you locking yourself out for good.
