AI Agents Accessing AWS: The IAM Patterns That Scare Me
The patterns that actually make AI agents in AWS dangerous — and the guardrails I run when giving Claude access to my own AWS accounts.
Iam
AWS IAM Identity Center: Account Access Is Now Optional — And Why That Matters
AWS IAM Identity Center now supports new organization instances without account access management enabled — no more service-linked role in every member account. When to use it, when to skip it, and the migration considerations for existing instances.
AWS IAM Permission Boundaries: The Sandbox Pattern That Actually Works
How to use IAM permission boundaries to sandbox developers in AWS — with the sandbox pattern I deploy for clients, the mental model people get wrong, and when to reach for boundaries instead of SCPs.
AWS CloudTrail Log Analysis: How to Find Who Did What (And When)
How to actually use CloudTrail logs day-to-day — tracing non-compliant resources to their source, querying with Athena, and setting up alerts before things go wrong.
AWS SCPs That Actually Work: Practical Guide for Real Teams
SCPs every AWS org should deploy on day one — plus the break-glass pattern, limit gotchas, and why you shouldn’t use SCPs to fix human behavior.
AmazonSSMManagedInstanceCore: Full Policy Breakdown
Full breakdown of every permission in the AmazonSSMManagedInstanceCore IAM policy, plus a least-privilege custom alternative for production EC2 instances.
AWS Misconfigurations I Find in Every Security Audit
Five AWS misconfigurations I find in every security audit — with Console and Terraform fixes for public S3 buckets, over-permissive IAM, open security groups, and missing monitoring.
AWS Security Checklist: The 30-Minute Audit I Run on Every Account
The 30-minute security baseline I run on every AWS account — 10 sections with copy-paste CLI commands covering IAM, S3, CloudTrail, network hardening, and cost monitoring.
IAM Users Are Dead: Modern AWS Access Control for 2026
Stop using IAM users in AWS. This guide explains why they’re risky and how to migrate to Identity Center, STS, and OIDC-based access — step-by-step.
Detect AWS IAM Privilege Escalation with CloudTrail
Set up AWS-native detection for privilege escalation using CloudTrail, EventBridge, and minimal infrastructure. Real API patterns and alerting included.
IAM Least Privilege in AWS: Access Analyzer Guide
How to audit and refine IAM permissions using Access Analyzer, CloudTrail, and service access history — enforcing least privilege the right way in AWS.
AWS Session Manager Setup: Replace SSH with Zero Inbound Ports
Step-by-step SSM Session Manager setup — IAM role, instance profile, session logging, and removing SSH entirely. No keys, no bastions, no port 22.
Stop Using AWS Access Keys: The Temporary Credentials Playbook
Kill long-term AWS access keys for good. A step-by-step playbook using IAM roles and STS to lock down access in under a day — with the mistakes to skip.
Automate IAM Least Privilege with Access Analyzer & Terraform
Automate least-privilege IAM roles using Access Analyzer policy generation, CloudTrail-based scoping, and Terraform integration.