Cognito | John Nessime

Tenant Isolation on AWS: Building a Multi-Tenant Workshop Platform That Doesn’t Leak

Post category:Cloud Computing Cloud Security SaaS Engineering

A missing tenant filter doesn't throw an error, it returns a 200 with too many rows. This is how to build a multi-tenant workshop management platform on AWS where the isolation boundary sits below your application code: STS session tags feeding IAM conditions, DynamoDB leading keys, scoped S3 prefixes, forced PostgreSQL row-level security, and a control plane that verifies each new tenant is fenced before anyone logs in.

Cognito MFA for Healthcare Apps: The Settings That Look Compliant but Aren’t

Post category:Cloud Computing Compliance Web Security

A user pool set to "MFA: Required" can still let clinicians in on a password alone. This is a practical guide to Cognito MFA for healthcare apps: why federated users bypass enforcement, how the account recovery collision locks people out, why required MFA and adaptive authentication cannot coexist, and how to make session lifetimes match what your documentation claims.

Building a Salesforce AI Assistant on Amazon Bedrock Without Leaking Your CRM

Post category:Cloud Computing DevOps Technical Guides

The demo works, then someone sees records they shouldn't. Nothing errors. Here's how to build a Salesforce AI assistant with Amazon Bedrock that respects your sharing model: which doors AWS and Salesforce just closed, why identity propagation is the failure mode that bites, and how to shape the tool surface so the agent can't wander.

AWS Amplify vs Firebase: Choosing a Backend You Can Still Leave

Post category:Cloud Computing DevOps Technical Guides

Both platforms look identical on day one: a schema file, a typed client, a deploy that works. The difference shows up months later, in the queries you cannot afford and the layer you cannot leave. A practical comparison of data models, billing shape, auth stickiness and exit cost.