Wire up an AWS billing alarm before the surprise
Setting up an AWS billing alarm before you need one, with a KMS gotcha in the middle that stops the alert ever reaching you.
Tags
12 pages
AWS
The security service I had to switch off
A fresh AWS account cannot enable GuardDuty or Security Hub without a subscription, so the security baseline failed on the account it protects.
A 403 you can't fix in IAM
A GitLab to AWS OIDC trust policy kept returning 403, and no IAM change fixed it: the policy matched a claim GitLab never actually asserts.
Routing security findings without the noise
Routing AWS GuardDuty and Security Hub findings so an alert still means something: forward high severity only, and drop the duplicates.
Hardening the account that will hold the keys
Applying a security baseline to a fresh AWS account: audit logging, config recording, threat detection and an operator role that is not root.
No access keys in CI
Replacing long-lived AWS access keys in CI with OIDC federation, so the pipeline mints a short-lived token instead of holding a secret.
Two layers of tags, and which one wins
AWS tagging in two layers: account-wide invariants on the provider default tags, resource specifics in the module, and which one wins on a clash.
The chicken-and-egg of remote state
The bootstrap stack has to create the bucket its own state lives in. Applying once with a local backend, then migrating the state into it.
The cleanup tool that almost deleted its own hands
Reading an aws-nuke dry run: the screenfuls of red are harmless noise, and the real hazard is one quiet line in the middle of them.
The security finding you must not fix
A checkov finding you must suppress rather than fix: that KMS policy statement is the escape hatch that stops you locking yourself out for good.
