AWS Security & Compliance

Nash Ogden

Published articles: 53

Articles (53) — Page 2

Security & Compliance
Jun 4, 2026nash ogden7 min
AWS KMS Encryption Architecture (2026): The Per-Tenant CMK Trap, the 10,000 req/s Shared Quota, and When AWS-Owned Keys Win
Most KMS guides stop at "enable encryption." The architecture decision that actually bites is the key boundary: split one CMK into 3,200 per-tenant keys and you pay ~$3,200/mo in key storage alone while still sharing a single 10,000 req/s symmetric quota. Here is the decision matrix, the throttle math, and the encryption-context pattern that gives per-tenant isolation without per-tenant keys.
aws-kms
encryption
security
kms
cost-optimization
aws
Read article
Security & Compliance
May 22, 2026nash ogden4 min
AWS Data Residency and Sovereignty in 2026: Regions, Inference Boundaries, and What Actually Stays in Country
The AWS European Sovereign Cloud reached GA in Brandenburg on January 15, 2026—but most EU SaaS workloads still fit standard EU regions plus DPA/SCC. This guide separates data at rest, inference routing (Bedrock geographic vs global profiles), and when sovereign cloud is worth the premium.
data-residency
gdpr
amazon-bedrock
aws-regions
compliance
sovereignty
Read article
Security & Compliance
May 21, 2026nash ogden4 min
AWS CSPM: Native Security Hub Stack vs Third-Party (Wiz, Orca) — 2026 Decision Guide
After Security Hub Essentials consolidated Inspector and CSPM into per-resource pricing (example: 500 units ≈ $1,875/mo), most AWS-only estates should run native first. This guide scores when Wiz/Orca-class tools earn a line item—and when paying twice for the same CVE is the real failure mode.
security-hub
cspm
inspector
guardduty
aws-security
compliance
Read article
Security & Compliance
May 13, 2026nash ogden5 min
AWS Security Agent Full Repository Code Review: Trust Boundaries Beyond Pattern-Only SAST
July 2026 placement guide for AWS Security Agent full-repository code review (announced May 12, 2026): trust-boundary and data-flow analysis beside Inspector, CI SAST, and a reproducible pilot checklist — still preview terms; confirm console pricing.
aws-security
application-security
devsecops
ci-cd
security-agent
Read article
Security & Compliance
May 8, 2026nash ogden2 min
CI/CD Threat Models and Web App Security on AWS: Pipelines, XSS, CSRF, and SQL Injection
GitHub Actions OIDC role sessions are short-lived by design—teams still paste static access keys into workflow logs until scanners or audits catch the diff; supply-chain writeups keep repeating the pattern into 2026.
github-actions
aws-security
aws-waf
ci-cd
owasp
Read article
Security & Compliance
Apr 28, 2026nash ogden7 min
Amazon Bedrock Automated Reasoning Checks: Production Hallucination Prevention with Math-Validated Factuality
Bedrock Automated Reasoning checks ground LLM outputs against formal logic policies you encode and mathematically validate that the response is consistent with the policy. This guide covers when to use Automated Reasoning vs contextual grounding, how to author the policy in production, the integration with Bedrock Guardrails, and the regulated use cases (HR, insurance, eligibility, regulatory determinations) where the difference matters.
amazon-bedrock
automated-reasoning
guardrails
ai-security
hallucination
genai-governance
aws
Read article
Security & Compliance
Apr 28, 2026nash ogden8 min
AWS CloudTrail Production Setup: Multi-Region Trails, Log File Validation, and CloudTrail Lake
Production CloudTrail: multi-region org trails, log validation, CMK, Lake + Athena. July 2026 checklist — Event History is not enough.
cloudtrail
security
aws
compliance
audit
Read article
Security & Compliance
Apr 28, 2026nash ogden8 min
AWS EBS Encryption and Snapshot Hygiene: Default Encryption, Public Snapshot Prevention, and KMS Key Lifecycle
EBS default encryption per Region, CMK lifecycle, block public snapshots. July 2026 baseline checklist — retrofit is expensive.
ebs
kms
security
aws
compliance
Read article
Security & Compliance
Apr 28, 2026nash ogden8 min
AWS IAM Identity Center: Workforce SSO and Identity Propagation in Production
AWS IAM Identity Center is the AWS-native workforce SSO and identity-propagation service. This guide covers federation from Okta / Microsoft Entra ID, permission-set design, attribute-based access control (ABAC), identity propagation to Q Business / Redshift / QuickSight / S3 Access Grants, and the migration off long-lived IAM users.
iam
iam-identity-center
sso
federation
identity-propagation
access-control
aws
Read article
Security & Compliance
Apr 28, 2026nash ogden7 min
AWS KMS Post-Quantum Cryptography: ML-KEM Hybrid TLS and ML-DSA Signatures in Production
AWS KMS ML-KEM hybrid TLS + ML-DSA signatures. July 2026: when to enable PQC, performance, migration checklist for HNDL risk.
kms
post-quantum
ml-kem
ml-dsa
cryptography
data-security
encryption
aws
Read article
Security & Compliance
Apr 28, 2026nash ogden7 min
Amazon Macie + Detective on AWS: Data Security Posture Management and Forensic Investigation in Production
Macie + Detective: S3 DSPM and forensic graphs. July 2026 — scope costs, KMS decrypt, paired Security Hub pipeline.
macie
detective
dspm
data-security
threat-detection
forensics
s3-security
aws
Read article
Security & Compliance
Apr 28, 2026nash ogden6 min
AWS Network Firewall + Firewall Manager: Multi-Account Stateful L3-L7 Defense in Production
Network Firewall + Firewall Manager for Org-wide L3–L7. July 2026: centralized inspection, Suricata, TLS bypass, rollout checklist.
network-firewall
firewall-manager
vpc-security
network-security
multi-account
control-tower
aws
Read article

Newer posts

Older posts

Work With Us

Our articles share what we know. Our consulting engagements apply that knowledge to your specific AWS environment.

Talk to AWS Experts