palaniappan p9 min
AWS CloudTrail Production Setup: Multi-Region Trails, Log File Validation, and CloudTrail Lake
Production CloudTrail: multi-region org trails, log validation, CMK, Lake + Athena. July 2026 checklist — Event History is not enough.
Tag: aws
palaniappan p9 minAWS EBS Encryption and Snapshot Hygiene: Default Encryption, Public Snapshot Prevention, and KMS Key Lifecycle
EBS default encryption per Region, CMK lifecycle, block public snapshots. July 2026 baseline checklist — retrofit is expensive.
palaniappan p9 minAWS IAM Identity Center: Workforce SSO and Identity Propagation in Production
AWS IAM Identity Center is the AWS-native workforce SSO and identity-propagation service. This guide covers federation from Okta / Microsoft Entra ID, permission-set design, attribute-based access control (ABAC), identity propagation to Q Business / Redshift / QuickSight / S3 Access Grants, and the migration off long-lived IAM users.
- palaniappan p7 min
AWS KMS Post-Quantum Cryptography: ML-KEM Hybrid TLS and ML-DSA Signatures in Production
AWS KMS ML-KEM hybrid TLS + ML-DSA signatures. July 2026: when to enable PQC, performance, migration checklist for HNDL risk.
- palaniappan p8 min
Amazon Macie + Detective on AWS: Data Security Posture Management and Forensic Investigation in Production
Macie + Detective: S3 DSPM and forensic graphs. July 2026 — scope costs, KMS decrypt, paired Security Hub pipeline.
palaniappan p7 minAWS Network Firewall + Firewall Manager: Multi-Account Stateful L3-L7 Defense in Production
Network Firewall + Firewall Manager for Org-wide L3–L7. July 2026: centralized inspection, Suricata, TLS bypass, rollout checklist.
palaniappan p7 minAWS RDS Performance and Caching: IOPS, Query Tuning, and Application-Layer Cache Patterns
RDS performance: gp3 IOPS, Performance Insights / Database Insights, Proxy, replicas, ElastiCache. July 2026 tuning checklist.
palaniappan p9 minAWS Resource Hardening Quick Wins: DMS, OpenSearch, SageMaker, and Lambda Runtimes
Hardening quick wins: private DMS, OpenSearch encryption, SageMaker VPC-only, Lambda runtime EOL. July 2026 checklist.
- palaniappan p7 min
AWS Verified Access in Production: A Zero-Trust Network Access (ZTNA) Replacement for Legacy VPN
Verified Access ZTNA: Cedar policies, Identity Center, TCP endpoints (GA). July 2026 Client VPN migration checklist.
palaniappan p9 minDORA Compliance on AWS: A Practical Guide for EU Financial Entities and ICT Third-Party Providers
DORA on AWS since Jan 2025: RoI, TLPT/TIBER-EU, incident clocks, Artifact addendum. July 2026 readiness checklist.
palaniappan p9 minEU AI Act on AWS: A Practical Compliance Guide for High-Risk AI on Bedrock and SageMaker
EU AI Act compliance on AWS — risk classification, prohibited practices, GPAI obligations, the high-risk Annex III framework (enforceable 2 August 2026), and the AWS-native control mapping using Bedrock Guardrails, SageMaker Model Cards, and Audit Manager governance.
palaniappan p8 minBuilding a Vulnerability Management Program on AWS: CVSS, KEV, and Reachability
How to build a vulnerability management program that scales beyond CVE-counting. Inspector v2 deployment, CVSS + CISA KEV + reachability for risk-based prioritization, container and IaC scanning in CI/CD, and remediation SLAs that survive audits.