Why a GKE Ingress can look fine in kubectl and still have no IP — and how that differs from EKS and ALB If you have used EKS, HTTP Ingress usually means an Application Load Balancer. Someone installs the AWS Load Balancer Controller, you set ingressClassName: alb, and AWS creates an ALB. Certificates often come […]
How do you redirect thousands of customer subdomains in AWS? Without creating an ALB rule for every customer? A few weeks ago I got handed something that sounded like a non-issue. Redirect a subdomain to a path. One line in the ticket, basically. I assumed I’d knock it out before lunch, and instead spent most […]
Security incidents in AWS rarely stem from zero-day exploits against the hypervisor. In practice, they trace back to routine configuration drift: an IAM policy wildcard added at 2 AM to fix a broken deployment, a database spun up in a public subnet for staging, or a security group rule left open to 0.0.0.0/0. AWS operates […]
Introduction This blog provides step-by-step instructions to implement AWS IAM Identity Center with Microsoft Entra ID as the identity source. Authentication is handled via SAML 2.0. User and group provisioning is handled via SCIM 2.0. IAM Identity Center is administered from a dedicated Identity account using Delegated Administration. Prerequisites AWS Organization active with All Features […]
Introduction As applications move from monoliths to microservices, every new service tends to expose its own API. That sounds fine at first—until each service also has to handle its own authentication, rate limiting, logging, and routing. The result is duplicated logic scattered across every service, and clients that need to know about every backend individually. […]
Introduction Imagine running a restaurant during lunch hour. Hundreds of customers suddenly arrive, so you quickly bring in more chefs and waiters. When the rush is over, keeping all those extra employees around would be unnecessary and expensive. Applications running on Kubernetes face a similar challenge. At certain times, an application may receive thousands of […]
Introduction When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API’s in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources […]
Introduction Relying on a single AWS account for enterprise workloads creates a critical structural bottleneck that limits security and scalability. At the beginning of your cloud journey, a single account is perfect: developers have agility, networks are simple, billing is straightforward. However, as your footprint grows, a single account is a recipe for disaster. You’ll […]
Locking Down the Front Door: IAM and Access Control in AWS Most AWS breaches don’t start with a zero-day exploit. They start with an over-permissioned role, a leaked access key, or a policy that grants *:* (a wildcard meaning “every action, on every resource”) because it was faster than scoping it properly. Identity and Access […]
