All Posts 📚

A global data perimeter turns "who has access to what" from a per-account promise into an org-wide guarantee. This article walks through how I designed and rolled one out across a large multi-account AWS estate in a regulated banking environment — the architecture, the audit-mode-first rollout, and the exceptions that actually happened.

Part 2 of my Boundary Kubernetes lab: replace static passwords with Vault-issued dynamic MySQL users and short-lived SSH certificates per session.

I deployed HCP Boundary Essentials on a local Minikube cluster to broker zero-trust access to a MySQL database and an SSH target — no direct exposure, credential injection, and full session control via the Boundary CLI or Boundary Desktop. Here is the full architecture, configuration, and what I learned.

AWS has four distinct mechanisms to restrict permissions — and most engineers confuse them. This article breaks down SCPs, RCPs, Permission Boundaries and Session Policies: what each one limits, where it sits in the evaluation engine, and when to use which.

Transit gateways get the job done, but they come with real operational weight. I rebuilt the same infrastructure using Amazon VPC Lattice — here is what changed, what got simpler, and why it matters.