DevSecOps
IAM Roles That Fail Loud: Small Defaults, Big Difference
A small Pulumi library that treats IAM safety as a precondition: mandatory permissions boundary, no wildcard trust, no wildcard actions, every opt-out explicit.
RivasSec
Infrastructure. Security. Insight.
Field notes on infrastructure security, cloud hardening, Kubernetes, IAM, and OSINT by RivasSec.
Start here
Latest posts
IAM Blast Radius Is an Architecture Problem, Not a Policy Problem
Most IAM reviews start too late, after the account structure and trust boundaries are set. Least privilege isn't fewer actions; it's smaller failure domains.
Continue reading
IAM Roles That Fail Loud: Small Defaults, Big Difference
A small Pulumi library that treats IAM safety as a precondition: mandatory permissions boundary, no wildcard trust, no wildcard actions, every opt-out explicit.
Continue reading
Elasticsearch Snapshot Verification, Minimal Privileges
Verify Elasticsearch snapshots without manage_snapshot: minimal API key, Prometheus-friendly script, and a public tools repo for hardened monitoring automation.
Continue reading