Read the report without ever holding the key
Publish an OpenPGP certificate a researcher can encrypt to, and read what they send, without a private key ever existing in your process.
Tags
14 pages
AWS
The runner fleet that scales to zero
The homelab finally ran out. Not disk this time, capacity. So the overflow went to AWS, on the condition that it costs nothing when nobody's pushing.
Wire up an AWS billing alarm before the surprise
Setting up an AWS billing alarm before you need one, with a KMS gotcha in the middle that stops the alert ever reaching you.
The security service I had to switch off
A fresh AWS account cannot enable GuardDuty or Security Hub without a subscription, so the security baseline failed on the account it protects.
A 403 you can't fix in IAM
A GitLab to AWS OIDC trust policy kept returning 403, and no IAM change fixed it: the policy matched a claim GitLab never actually asserts.
Routing security findings without the noise
Routing AWS GuardDuty and Security Hub findings so an alert still means something: forward high severity only, and drop the duplicates.
Hardening the account that will hold the keys
Applying a security baseline to a fresh AWS account: audit logging, config recording, threat detection and an operator role that is not root.
No access keys in CI
Replacing long-lived AWS access keys in CI with OIDC federation, so the pipeline mints a short-lived token instead of holding a secret.
Two layers of tags, and which one wins
AWS tagging in two layers: account-wide invariants on the provider default tags, resource specifics in the module, and which one wins on a clash.
The chicken-and-egg of remote state
The bootstrap stack has to create the bucket its own state lives in. Applying once with a local backend, then migrating the state into it.
