https://tch.guru/blog My personal blog where I share thoughts about cloud and cybersecurity en-us undefined (Christian TCH) undefined (Christian TCH) Mon, 14 Sep 2026 00:00:00 GMT https://tch.guru/blog/global-data-perimeter-aws-organizations https://tch.guru/blog/global-data-perimeter-aws-organizations A global data perimeter turns "who has access to what" from a per-account promise into an org-wide guarantee. This article walks through how I designed and rolled one out across a large multi-account AWS estate in a regulated banking environment — the architecture, the audit-mode-first rollout, and the exceptions that actually happened. Mon, 14 Sep 2026 00:00:00 GMT undefined (Christian TCH) awssecurityiamcloud-securityorganizationsterraform https://tch.guru/blog/hashicorp-boundary-poc-kubernetes https://tch.guru/blog/hashicorp-boundary-poc-kubernetes I deployed HCP Boundary Essentials on a local Minikube cluster to broker zero-trust access to a MySQL database and an SSH target — no direct exposure, credential injection, and full session control via the Boundary CLI or Boundary Desktop. Here is the full architecture, configuration, and what I learned. Wed, 20 May 2026 00:00:00 GMT undefined (Christian TCH) securitypamhashicorpboundarykubernetesterraformzero-trust https://tch.guru/blog/iam-cleanup-automated-governance https://tch.guru/blog/iam-cleanup-automated-governance Dormant IAM credentials are not harmless — they are a ticking time bomb. I built IAM Cleanup, a serverless tool that automatically detects, tags, and removes unused IAM roles and policies before they become a liability. Tue, 31 Mar 2026 00:00:00 GMT undefined (Christian TCH) awsiamsecuritycloud-securityterraformautomation https://tch.guru/blog/vault-dynamic-creds-with-boundary-kubernetes https://tch.guru/blog/vault-dynamic-creds-with-boundary-kubernetes Part 2 of my Boundary Kubernetes lab: replace static passwords with Vault-issued dynamic MySQL users and short-lived SSH certificates per session. Mon, 15 Jun 2026 00:00:00 GMT undefined (Christian TCH) securityhashicorpboundaryvaultkubernetesterraformzero-trust https://tch.guru/blog/vpc-lattice-replacing-transit-gateway https://tch.guru/blog/vpc-lattice-replacing-transit-gateway Transit gateways get the job done, but they come with real operational weight. I rebuilt the same infrastructure using Amazon VPC Lattice — here is what changed, what got simpler, and why it matters. Thu, 16 Apr 2026 00:00:00 GMT undefined (Christian TCH) awsnetworkingvpc-latticeterraformcloud-architecture