Insights
Cloud security insights & expertise
Articles, war stories and practical analyses for teams securing critical workloads in the cloud.
Supply chain
GitHub Actions: the 10 misconfigurations that give an external contributor production access
pull_request_target, ${{ }} injection, write-all, unpinned actions: the 10 workflow mistakes that open production to an outside PR, with a fixed workflow and zizmor in CI.
Cloud posture
IAM privilege escalation: the 8 patterns found in almost every SMB
iam:PassRole, CreatePolicyVersion, UpdateAssumeRolePolicy: 8 common IAM escalation paths, how to block them (SCP, conditions, Access Analyzer in CI) and how to prove it to an auditor.
AI security
AI agents calling your APIs: least privilege, hop by hop
A Bedrock agent on a single IAM role is a shared admin account. Workload identity, On-Behalf-Of token exchange, per-tool Gateway authorization: the method and artefacts.
Supply chain
Hardening Argo CD AppProjects: the multi-tenant control everyone leaves wide open
DevSecOps case analysis: neutralize the default project, restrict sourceRepos and destinations, whitelist Kubernetes kinds, and prove project RBAC before an auditor does.
Ecosystem
Wiz + Terramate: check cloud configs before apply, not after the incident
DevSecOps case analysis: orchestrate changed Terramate stacks, scan the Terraform plan with wizcli, block critical misconfigs in CI, then correlate with Wiz runtime.
Cloud posture
Golden AMIs: building, distributing and enforcing hardened EC2 images in production
A complete Golden AMI pipeline: pinned base, hardening with EC2 Image Builder, publishing via SSM Parameter, and blocking every other image with SCPs, Allowed AMIs and AWS Config.
FinOps
ProsperOps and Savings Plans Automation: Real ROI, Pitfalls, and When It's Not Worth It
ProsperOps automates AWS Savings Plans purchasing and laddering via a Savings Share model. Real ROI against the native Cost Optimization Hub, and when an organization should skip it.
Ecosystem
Grafana Cloud vs Datadog vs Honeycomb: which AWS observability tool in 2026
CloudWatch, Grafana Cloud, Datadog, Honeycomb: four radically different pricing models for the same need. A numbers-first comparison for an AWS organization choosing in 2026.
FinOps
Vantage, CloudZero, Cloudability: which FinOps SaaS tool to pick under $100K/month on AWS
Is Cost Explorer still enough? A hard-numbers comparison of Vantage, CloudZero and Cloudability for an AWS organization spending $10K-$100K/month: real pricing, what they add over native, and when to stay on AWS alone.
Ecosystem
Kubecost on EKS: measuring the real cost per team and per service
EKS bills a flat lump sum, not a cost per team. Split Cost Allocation Data (AWS-native) and Kubecost: a concrete method to attribute the bill by namespace and service.
FinOps
Datadog bill spiraling out of control? The concrete levers on logs, metrics and APM
Over-indexed logs, uncontrolled metric cardinality, APM enabled everywhere: the three line items that blow up Datadog bills, and the Terraform levers to rein them in without losing visibility.
Ecosystem
Prisma Cloud (Cortex Cloud): overkill, or genuinely worth it against Wiz and Orca?
Prisma Cloud is now Cortex Cloud at Palo Alto Networks. Against Wiz (acquired by Google) and Orca, does it earn its place in an AWS organization's security budget, or is it overkill?
FinOps
Savings Plans vs Reserved Instances in 2026: The Complete Decision Tree
Compute SP, EC2 Instance SP, Standard RI, Convertible RI: the 4 AWS commitment mechanisms compared, with a decision tree and a worked example for organizations.
Architecture
Backup and Disaster Recovery on AWS: The Minimum Viable Setup
AWS Backup, Vault Lock, Elastic Disaster Recovery: what an organization actually needs to survive a ransomware attack or a human error, without over-investing.
Ecosystem
Datadog vs CloudWatch on AWS: when to pay for a third party, when to stay native
CloudWatch and Datadog don't bill the same way — per-unit vs per-host. Official pricing, a worked example on a 15-server organization, and the real factor that blows up the bill.
FinOps
AWS Egress Fees: Mapping and Cutting Your Data Transfer Costs Before January 2027
Internet egress, cross-AZ, NAT Gateway: how to map your AWS data transfer costs and cut them before the EU Data Act bans all switching fees on 12 January 2027.
Architecture
EKS vs ECS vs Fargate: the real cost/complexity comparison
ECS, EKS or Fargate for an AWS organization: real costs (EKS control plane, eu-west-3 Fargate rates), operational complexity, and a concrete decision tree to choose.
Security & Compliance
GDPR and data residency on AWS: why eu-west-3 isn't always enough
eu-west-3 checks the GDPR box but not the CLOUD Act one. Between AWS European Sovereign Cloud (launched January 2026) and SecNumCloud, a decision framework for French organizations.
FinOps
RDS: 7 cost optimization levers nobody activates
gp3 storage, Reserved Instances vs Database Savings Plans, Graviton, Performance Insights: 7 concrete levers to cut an organization's RDS bill in 2026.
Ecosystem
Wiz vs AWS Security Hub + GuardDuty: what a third-party CSPM really adds
GuardDuty and Security Hub cover threat detection and AWS posture natively. Wiz, bought by Google for $32B in 2026, promises more — at what cost, for which organization, on what criteria?
Architecture
Well-Architected Review: what an audit really finds, notes from the field
What an AWS Well-Architected Review actually finds in organizations: average number of High Risk Issues, common traps, and how to claim up to $5,000 in AWS credits.
AI Engineering
Amazon Bedrock: profitable use cases and the costs to plan for
Which Bedrock use cases are actually profitable for an organization, and which hidden costs (Knowledge Bases, vector store, Guardrails) blow up the bill.
Security & Compliance
AI Act: the real 2026-2027 compliance timeline after the Digital Omnibus delay
The Digital Omnibus pushed the AI Act's high-risk obligations to December 2027. What's still due right now, what got delayed, and why waiting is risky for organizations.
FinOps
Graviton: migrating your workloads to ARM without breaking anything
Evaluation method, real-world savings, and the pitfalls to avoid when migrating AWS workloads to Graviton (ARM) without operational risk.
FinOps
Cutting your AWS bill without breaking your architecture: practical methods
Proven FinOps methods to recover 30-50% of an organization's AWS bill without introducing operational risk.
Security & Compliance
Preparing a SOC2 audit on AWS without slowing your team down
The proven sequence to prepare a SOC2 Type 1 or Type 2 audit on AWS in 90 days, with technical controls per layer.
Architecture
AWS multi-account: 5 critical mistakes to avoid in 2026
The most expensive anti-patterns in AWS multi-account architecture, and how to avoid them with a minimal Landing Zone.
FinOps
FinOps: where your AWS costs are really hiding
The most underestimated AWS cost lines for organizations — data transfer, NAT Gateway, CloudWatch, orphan resources. With CLI commands to hunt them down.