CloudTrail Event History on the default plan isn't your audit trail — it's a 90-day story you tell auditors. A production CloudTrail setup with multi-region trails, KMS encryption, log file integrity validation, and CloudTrail Lake as the queryable layer for incident response and compliance evidence.
EBS encryption is one of the easiest controls to get right — and one of the most expensive to retrofit. Account-level default encryption, re-encrypting legacy volumes without downtime, blocking public snapshots, and operating the KMS key lifecycle without losing data to accidental deletion.
Service-by-service hardening for the AWS resources most often flagged by compliance scanners — DMS replication instances, OpenSearch encryption at rest, SageMaker network isolation, and Lambda runtime end-of-life management.
DORA (Regulation (EU) 2022/2554) on AWS — scope, the ICT risk-management framework, the third-party register, threat-led penetration testing under TIBER-EU, the major-incident reporting timeline, and the AWS-native control mapping for financial entities and their ICT service providers.
How to build a vulnerability management program that scales beyond CVE-counting. Inspector v2 deployment, CVSS + CISA KEV + reachability for risk-based prioritization, container and IaC scanning in CI/CD, and remediation SLAs that survive audits.
GDPR compliance on AWS for SaaS companies handling EU resident data. Region selection, the AWS DPA, data subject rights automation, RoPA documentation, breach notification, and the technical controls regulators expect.
SOC 2 closes North American deals. ISO 27001:2022 closes the European and Japanese ones. Building an ISMS that survives Stage 1 and Stage 2 audits, mapping the 93 Annex A controls to AWS services, and producing the evidence packages assessors actually request.
NIS2 compliance on AWS for EU operators of essential and important services. Scope assessment, the 24-hour and 72-hour incident reporting clock, supply-chain risk controls, and the AWS service mapping for the 10 minimum measures.
How to operationalize NIST CSF 2.0 on AWS — the new Govern function, the six core functions mapped to AWS services, maturity tier progression, and the relationship to NIST SP 800-53, SP 800-171, and CMMC.
A security hardening PR in the AWS CLI applied chmod 0600 to any output path — including /dev/null — silently breaking Lambda invocations, S3 streaming commands, and every other process on affected hosts overnight.
Most AWS security breaches aren't caused by AWS failures — they're caused by misconfiguration. Here are 10 concrete best practices to harden your AWS environment in 2026.
Real AWS DevOps practices from production: GitOps on EKS, OpenTelemetry, supply chain security, chaos engineering with FIS, and AI-assisted DevOps with Amazon Q.
