Security Articles & Deep Dives
In-depth Security articles and technical deep dives from the Private DevOps team - architecture patterns, trade-offs, and production-grade analysis for infrastructure teams.
14 articles in this topic
How to Give Applications AWS Credentials Without Storing Any
Every long-lived access key in your account is a copy waiting to leak, and no amount of rotation discipline fixes that. The alternative is to have no key at all, because each place an application normally needs credentials already has a mechanism that hands it fresh ones on demand. This walks through instance profiles on EC2, task roles on ECS, EKS Pod Identity and IRSA on Kubernetes, and OIDC federation for a CI pipeline, with the trust policy shape for each. It also covers the one condition in the CI trust policy that decides whether the whole thing is secure or theatre.
Read articleHow to Make an S3 Bucket That Cannot Be Deleted by Accident
Protecting a bucket against a mistake and protecting it against a stolen credential are two different jobs, and the settings that do one do not do the other. This walks through versioning, MFA delete and Object Lock in both of its modes, what each one can and cannot be undone by, and where an attacker with the right permission walks straight through your protection. Several of these settings cannot be reversed once enabled, including one where AWS says the only remaining way to delete the data is to close the account, so the warnings sit next to the commands.
Read articleHow to Set Up Least Privilege IAM Without Blocking Your Own Team
Least privilege earns its reputation for costing a week of tickets whenever someone writes the minimal policy first and discovers what was missing by breaking people's work. The order that avoids that is the reverse. Cap the blast radius, let the team work, collect evidence about what was actually used, and tighten against the evidence. This covers the AWS reporting that supplies the evidence, exactly what data each report is built from and what it silently omits, and the checks that catch an over-tightened policy before it ships.
Read articleHow to Handle Secrets in CI Without Leaking Them Into Logs
The safest credential in your pipeline is the one that does not exist between jobs. OpenID Connect lets a workflow authenticate directly to a cloud provider and receive a token that expires on its own, which removes the stored key entirely. Masking is the backstop for everything left over, and it is worth knowing exactly where it stops working, because it relies on finding an exact match for the value. This guide covers the short-lived credential setup, the limits of redaction, and what to actually do in the ten minutes after a secret reaches a log.
Read articleHow to Read a CVE and Decide in Ten Minutes If It Touches You
An alarming headline and a severity score are not a decision, and the score cannot become one because the part of it that would describe your environment is the part nobody filled in. This is the ten minute route from a CVE number to a defensible answer, covering what the scoring specification actually says, why your installed version number may be lying about whether you are patched, and which public sources report real exploitation rather than the possibility of it.
Read articleHow to Automate Certificates for Hundreds of Client Domains
Maximum certificate lifetimes are shrinking on a published schedule, so the number of renewals an agency or host runs each year is about to multiply twice over. This guide covers the pattern that survives it: DNS-01 validation with CNAME delegation, so a customer makes one record once and you never hold their zone credentials. It also covers which Let's Encrypt rate limit you meet first depending on how your names are shaped, why the authorization failure limit turns a small mistake into an outage, and how ACME Renewal Information takes the renewal schedule out of your hands entirely.
Read articleHow to Block an Attack Without Blocking Your Own Client
The rate limit that finally stops the credential stuffing is also the one that locks out your customer's head office on Monday morning, or quietly drops a payment provider's webhook and leaves a hundred orders unpaid. This guide builds the version that does not do that, starting with getting the real client address right behind a CDN, then an allowlist that works because nginx does not account requests with an empty key, a dry run week that shows you who you were about to break, and a fail2ban jail with the same allowlist repeated. It ends with the list of addresses that must never be banned.
Read articleHow to Set Up SPF, DKIM and DMARC So Mail Actually Lands
Three DNS records decide whether your invoices reach the inbox or the spam folder, and most setups have all three and still fail. The reason is alignment: DMARC does not ask whether SPF passed, it asks whether the domain SPF authenticated matches the domain in the From header. This is the working order to set them up, why SPF alone breaks the moment a message is forwarded, the ten lookup limit that silently voids your record, and how to move from p=none to p=reject without losing a week of mail.
Read articleHow to Kill Password SSH Across a Fleet, Once
Password authentication on SSH is the single setting that turns a leaked or guessed credential into a shell. Turning it off is five lines of config; doing it across a fleet without locking yourself out is the part that needs an order. This is that order, including the check that proves keys work before you disable the fallback, why AuthenticationMethods beats PasswordAuthentication alone, and how to leave one deliberate way back in.
Read articleEleven npm Packages Compromised in a 53 Minute Attack That Steals Every Credential Your Build Host Can Reach
On August 4, 2026 a worm pushed malicious versions of eleven npm caching packages inside a 53 minute window, harvesting npm tokens, GitHub PATs, AWS credentials, Kubernetes service account tokens and SSH keys. The headline was keyv and its 604 million monthly downloads, but keyv was the safest package on the list: its malicious release was a major version bump that no caret range accepts. The other ten were patch bumps, silently eligible for every dependency range in the ecosystem. That distinction, not the download count, decided who got hit. This is a practical guide to the defenses that actually change the outcome: what your semver range really grants, why npm install and npm ci are not interchangeable, when to disable install scripts and what breaks when you do, and how to check a tree you already have.
Read articleHow to Detect and Respond to a Compromised Linux Server
A practical incident response guide for Linux servers: identifying signs of compromise, initial triage, evidence preservation, containment, rootkit detection, and writing an incident report.
Read articleCompliance-Ready Infrastructure on AWS Guide
Build AWS infrastructure that meets SOC 2, HIPAA, and GDPR compliance requirements with automated controls, audit logging, and security guardrails.
Read articleAWS WAF Configuration for Web Application Security
Deploy and configure AWS WAF with managed rule groups, custom rules, rate limiting, and bot control to protect web applications from common threats.
Read articleKubernetes Network Policies for Microservices
Implement zero-trust networking in Kubernetes with network policies that control pod-to-pod traffic, namespace isolation, and egress filtering.
Read article