https://tch.guru/blog My personal blog where I share thoughts about cloud and cybersecurity en-us undefined (Christian TCH) undefined (Christian TCH) Tue, 05 May 2026 00:00:00 GMT https://tch.guru/blog/aws-guardrails-scps-rcps-permission-boundaries-session-policies https://tch.guru/blog/aws-guardrails-scps-rcps-permission-boundaries-session-policies AWS has four distinct mechanisms to restrict permissions — and most engineers confuse them. This article breaks down SCPs, RCPs, Permission Boundaries and Session Policies: what each one limits, where it sits in the evaluation engine, and when to use which. Tue, 05 May 2026 00:00:00 GMT undefined (Christian TCH) awsiamsecuritycloud-securityorganizations https://tch.guru/blog/aws-security-misconceptions https://tch.guru/blog/aws-security-misconceptions Three fundamental misconceptions about AWS security that create dangerous blind spots in your security posture. Mon, 02 Mar 2026 00:00:00 GMT undefined (Christian TCH) awssecurityiamcloud-security https://tch.guru/blog/global-data-perimeter-aws-organizations https://tch.guru/blog/global-data-perimeter-aws-organizations A global data perimeter turns "who has access to what" from a per-account promise into an org-wide guarantee. This article walks through how I designed and rolled one out across a large multi-account AWS estate in a regulated banking environment — the architecture, the audit-mode-first rollout, and the exceptions that actually happened. Mon, 14 Sep 2026 00:00:00 GMT undefined (Christian TCH) awssecurityiamcloud-securityorganizationsterraform https://tch.guru/blog/iam-cleanup-automated-governance https://tch.guru/blog/iam-cleanup-automated-governance Dormant IAM credentials are not harmless — they are a ticking time bomb. I built IAM Cleanup, a serverless tool that automatically detects, tags, and removes unused IAM roles and policies before they become a liability. Tue, 31 Mar 2026 00:00:00 GMT undefined (Christian TCH) awsiamsecuritycloud-securityterraformautomation