Designing an SCP Allow-List Under the 5,120-Character Limit
A long service allow-list can outgrow a single SCP. How to stay under the limit and keep it maintainable.
Writing
Field notes: what holds up in production.
Articles, short notes and production case studies on cloud security, identity and access, and policy-as-code: what worked, what didn't, and why. RSS
A 15-minute token doesn't mean a 15-minute connection
RDS IAM tokens expire in 15 minutes. The connections they open don't.
Pin the IRSA sub Condition, or Any Pod Can Assume the Role
An IRSA trust policy without an exact sub condition trusts every service account in the cluster.