Hardening the account that will hold the keys
Applying a security baseline to a fresh AWS account: audit logging, config recording, threat detection and an operator role that is not root.
Tags
39 pages
Security
No access keys in CI
Replacing long-lived AWS access keys in CI with OIDC federation, so the pipeline mints a short-lived token instead of holding a secret.
Secrets that scrub themselves from RAM
Storage answers where a secret lives, not what happens to it in memory. Wrapping secrets so they redact in Debug and zero on drop.
The cleanup tool that almost deleted its own hands
Reading an aws-nuke dry run: the screenfuls of red are harmless noise, and the real hazard is one quiet line in the middle of them.
The security finding you must not fix
A checkov finding you must suppress rather than fix: that KMS policy statement is the escape hatch that stops you locking yourself out for good.
A state bucket that defends itself
An OpenTofu state bucket that defends itself against corruption, deletion and its own operator, using lockfiles and prevent_destroy.
forbid means forbid, until linkme needs a word
forbid(unsafe_code) is absolute, which is a problem when a dependency emits a link_section the lint counts as unsafe. Where the line ends up.
A framework that contains no unsafe
Why every shipping crate uses forbid(unsafe_code) rather than deny, which any module inside it can quietly override from the inside.
A signing key needs somewhere to live
A checksum hosted beside your download stops accidents, not a compromised platform. Why the signing key has to live somewhere you control.
Waivers with an expiry date
A vulnerability scanner is a one-day yes or no. Running cargo-deny as a standing policy gate instead, with waivers that expire on a date.
