Publications and Content, 2014–2026
AWS Blogs, Whitepapers, and Publications
A control-by-control walk through all fourteen of the NCSC Cloud Security Principles, written for UK public sector teams putting OFFICIAL workloads on AWS: where the shared responsibility line sits for each principle, and what the customer still has to do. AWS has since archived it, and also hosts a copy.
Automated credential rotation for a stateful workload on Kubernetes, end to end.
The secure path is also the fast path here, which is usually the only way teams stop caching credentials badly on their own.
Continuous posture checking against a running cluster.
Service-to-service TLS in a mesh, with either managed or bring-your-own certificates.
Launch post for encryption at rest on Fargate’s ephemeral storage, in platform version 1.4.
Launch of the cross-industry hardening standard for EKS. This is the document enterprises and auditors now point at when they ask what “hardened” is supposed to mean.
An external identity provider wired directly into cluster authentication.
Continuous image vulnerability scanning, moved into the registry itself. It landed in the middle of the Log4j response, when every enterprise suddenly needed to know what was inside their images.
The reference document on Fargate’s isolation model: why each task and pod gets its own kernel, why neither customers nor AWS operators can reach the host, and where the shared responsibility line actually falls.
Cluster resources in the console, for the people who would rather not reach for kubectl.
The CIS EKS Benchmark covers the Kubernetes layer. This covers the operating system underneath it: an EKS worker AMI built on the CIS Amazon Linux 2 Level 2 hardened image, then run as a managed node group. Written for banks and other regulated customers who need Level 1 or Level 2 compliance on their nodes. Updated in May 2023 for changes to the EKS AMI build scripts.
Talks and sessions
Video cards play in place.
A 400-level session on admission control and policy enforcement, co-presented with a customer running it in production.
The benchmark control by control, and what it takes to actually pass it.
The full deck, ungated. Static and runtime container security across the service portfolio, including where image signing was heading at the time.
The baseline talk: what you own versus what the service owns, and where clusters actually get compromised.
Envelope encryption for Kubernetes secrets with customer-managed KMS keys.
Registry-level encryption, and why the registry belongs inside the supply chain boundary.
Cluster resources as typed code instead of hand-written YAML.
Security controls as pipeline stages. Pairs with the repo further down.
Containers from the Couch
Live and unscripted, mostly built alongside the founders and engineers of the tools instead of presented as slides about them. The channel.
Runtime threat detection with Falco, with the founder of the company that built it. Falco went to the CNCF later.
Built live with Alcide’s co-founder and CTO. Rapid7 acquired Alcide in February 2021.
Policy as code with the team behind OPA, before it became the default answer for Kubernetes admission control.
Git as the source of truth for cluster state, with the team that coined the term.
The benchmark run against a live cluster, then fixing what it flags.
A private registry encrypted with customer-managed keys, hands on.
How to debug inside a serverless container while leaving the isolation model intact.
Per-pod cloud credentials, replacing the shared node role most clusters started life with.
Cloud identity groups mapped onto Kubernetes RBAC, with a lot less config-map maintenance.
Guides and code
The open-source guide teams get pointed at when they ask how to secure a cluster properly. Also mirrored in the official EKS documentation.
A working GitHub Actions pipeline that goes from application code to an ECS Fargate deployment, with ECR KMS encryption and on-push image scanning as actual pipeline stages.
Merged upstream
Ignite runs Firecracker microVMs with a Docker-style workflow, and it needs KVM, which ordinary cloud VMs do not expose. Adds the project’s cloud provider guide: which EC2 bare metal instances give you hardware virtualization, with pricing at the time, plus a nested-virtualization image recipe for Google Cloud. Linked from the README and the installation guide.
Adds the eks-1.0 config and reworks the node-check job in kube-bench, the open-source scanner most teams use to test a cluster against the CIS benchmarks. 754 lines across 8 files, opened and merged the same day, eleven days before the CIS Amazon EKS Benchmark itself launched.
GaggiMate is an open-source controller for espresso machines. A 1.43-inch Waveshare AMOLED board boot-looped on it: no hardware config matched, so driver detection fell through to a panel driver written for entirely different silicon. Adds the GPIO mapping, teaches detection to cope with boards that have no real-time clock, and stops display init from writing to an enable pin that does not exist. Flashed and verified on the physical board.
The toolkit’s built-in wiki_search tool returned a 403 on a clean install. Wikipedia now requires a User-Agent header and the wikipedia package does not set one. Filed as issue #2156, fixed with unit tests, merged.
Links verified October 2026.