Notes from the work.
Notes from Cloud Certainty on AWS, Kubernetes, cloud cost and the products we build.
[ P ] LATEST POSTS
The BucketDeck security review: answers to the questions reviewers ask
A portal that can read and write your S3 data has to pass a security review. These are the questions reviewers ask about BucketDeck, answered with what the product does and what is left to you.
5 min read →
Moving data between S3 buckets and AWS accounts, without writing a script
Copying a few million objects between buckets, or between AWS accounts, usually means a script, a role in each account and a laptop that has to stay awake. Here is how BucketDeck runs it as a background job in your account, with dry runs, rename rules and retries.
3 min read →
S3 access per person, without an IAM user for each one
Giving someone access to one folder in one bucket usually means an IAM user or role, a hand-written policy and a CloudTrail log that only names the role. Here is how BucketDeck grants S3 access per user and group, and still shows the person in CloudTrail.
4 min read →
BucketDeck: your S3 buckets in one portal, in your own AWS account
BucketDeck is a web portal for Amazon S3 across every AWS account you connect. People browse, preview, search and move data with access set per user and per group, every action is audited, and the whole thing runs in your own account.
4 min read →
The resource relationships AWS Config doesn't record
AWS Config records relationships well for some services and barely at all for others. Here is how Config Explorer fills the gaps from ARNs and IDs in each configuration and from CloudFormation stacks, and why every link it infers is labelled.
4 min read →
Why your VPC shows hundreds of AWS Config changes, and how to find the real ones
Open the AWS Config timeline for a busy VPC and you will find hundreds of versions, almost none of which anyone made. Here is where they come from, and how to separate configuration, tag and relationship changes so the real edits stand out.
3 min read →
One inventory for your whole AWS organisation, from the Config bucket you already have
Control Tower already sends AWS Config data from every enrolled account to one bucket. Here is where those files are, what they cost to read, the permissions you need, and how to turn them into a single inventory.
4 min read →
Config Explorer: see what is in your AWS accounts, and how it connects
AWS Config already records every resource in your accounts and every change to it, and delivers the lot to S3. Config Explorer is a Windows app that turns those files into an inventory, a relationship map and a change log you can actually read.
3 min read →
What browser isolation costs on AWS: worked examples
Secure Browser costs $0.10 per session-hour plus the AWS resources it uses in your account. Here is what that adds up to for a single user, a contractor team and occasional investigations, and how to keep it low.
3 min read →