Cloud-Security

SCPs every AWS org should deploy on day one — plus the break-glass pattern, limit gotchas, and why you shouldn’t use SCPs to fix human behavior.

Five AWS misconfigurations I find in every security audit — with Console and Terraform fixes for public S3 buckets, over-permissive IAM, open security groups, and missing monitoring.

The 30-minute security baseline I run on every AWS account — 10 sections with copy-paste CLI commands covering IAM, S3, CloudTrail, network hardening, and cost monitoring.

How to map, audit, and automate CIS Benchmark compliance for EC2 instances using AWS Config, Security Hub, SSM, and open-source scanners.

Step-by-step SSM Session Manager setup — IAM role, instance profile, session logging, and removing SSH entirely. No keys, no bastions, no port 22.

This guide delves into the technical aspects of hardening EC2 instances, covering topics from instance selection to monitoring and automation, aligning with AWS’s security recommendations.

How to build a real AWS security monitoring stack without enterprise pricing — using CloudTrail, EventBridge, GuardDuty, and open-source tools like Wazuh and OpenSearch.

Ditch long-term access keys. Practical guide to IAM roles, STS, and temporary credentials — with real mistakes to avoid and least-privilege patterns that work.

The full framework for AWS incident response — why cloud IR is fundamentally different, how to build maturity progressively, and how to actually test your plan with tabletop exercises.

My real-world journey passing the AWS Certified Security – Specialty (SCS-C02) exam. Study strategies, mistakes, resources, and tips for future candidates.