ABAC | John Nessime

EKS Pod Identity vs IRSA: What Actually Decides the Choice

Post category:Cloud Security Containers Security Kubernetes

Both give your pods short-lived AWS credentials, but they put the cluster-to-role relationship in completely different places. A practical comparison of EKS Pod Identity vs IRSA: where each one wins, where each refuses to run, the silent node-role fallback that hides broken wiring, and a decision procedure you can apply per workload.

Tenant Isolation on AWS: Building a Multi-Tenant Workshop Platform That Doesn’t Leak

Post category:Cloud Computing Cloud Security SaaS Engineering

A missing tenant filter doesn't throw an error, it returns a 200 with too many rows. This is how to build a multi-tenant workshop management platform on AWS where the isolation boundary sits below your application code: STS session tags feeding IAM conditions, DynamoDB leading keys, scoped S3 prefixes, forced PostgreSQL row-level security, and a control plane that verifies each new tenant is fenced before anyone logs in.