Stop Giving Your AI Agents a Database Password
Replacing a static database password with short-lived, platform-issued identity: what it solves, and what it doesn't.
Writing
Field notes: what holds up in production.
Articles, short notes and production case studies on cloud security, identity and access, and policy-as-code: what worked, what didn't, and why. RSS
Designing an SCP Allow-List Under the 5,120-Character Limit
A long service allow-list can outgrow a single SCP. How to stay under the limit and keep it maintainable.
A 15-minute token doesn't mean a 15-minute connection
RDS IAM tokens expire in 15 minutes. The connections they open don't.
Allowed Isn't Reachable: Debugging Hybrid Network Paths
When the firewall says traffic is allowed but nothing gets through, stop reading rules and check the path.
Pin the IRSA sub Condition, or Any Pod Can Assume the Role
An IRSA trust policy without an exact sub condition trusts every service account in the cluster.
Migrating a Multi-Account AWS Organization from Legacy SSO to IAM Identity Center
Replaced legacy SAML SSO across 30+ AWS accounts. Built discovery tooling that scans a dozen resource surfaces and 100+ repositories for legacy role references, and a Terraform module defining permission sets for every engineering role, with Okta SCIM and separately managed break-glass access.
From Ungated to 100% Gated: Change Control and Security Scanning for Every Production Apply
Took production infrastructure changes from ungated to 100% gated: every Terraform apply across 200+ workspaces requires a ServiceNow change record and a clean Wiz scan, backed by a HashiCorp Sentinel policy library enforcing encryption, TLS and tagging standards.
Azure Identity as Code, Just-in-Time Admin Access, and Pipelines with No Stored Secrets
Tenant identity managed entirely in Terraform — management groups, custom RBAC roles, 30+ service principals — with just-in-time admin access through Entra ID PIM and OIDC workload identity federation, so pipelines store no cloud credentials.
Guardrails Before Accounts: An SCP Allow-List, Control Tower as Code, and Detection from Day One
SCP service allow-list (60+ approved services, all others denied), 50+ Control Tower controls as code, and GuardDuty, Security Hub and Config enabled for every new account, with findings forwarded to Microsoft Sentinel.
Rejecting Insecure Workloads Twice: Pipeline Scanning, Kyverno Admission Policies, and Pod-Level IAM
Enforced Kubernetes guardrails at admission and in the pipeline: Kyverno admission policies that block privileged pods, RBAC and namespace isolation, and Trivy and Aqua image scanning built into CI/CD, so insecure workloads are rejected before they run.
"The Firewall Says It's Allowed": Root-Causing a Multi-Day Hybrid Network Outage
Traced it to a Transit Gateway attachment in a Deleted state, restored the route table associations, propagations and return routes, and turned the diagnostic order into a repeatable drill for the team.
Building a Kubernetes Platform on Azure: Clusters from Code, Pipelines That Halved Deployment Time
Built Kubernetes clusters from scratch with Terraform across dev, staging and production (Helm deployments, autoscaling, ingress, RBAC and health probes) and Azure DevOps pipelines that cut deployment time by 50%. Infrastructure was defined in Terraform, ARM and Bicep, so every environment was built the same way.