IAM | Page 2 of 2 | John Nessime

Agentforce and AWS: Where the Trust Layer Stops and Your Logs Begin

Post category:Cloud Computing DevOps Technical Guides

Agentforce and AWS wire together in four standard patterns, and every one of them has a point where Salesforce's guarantees stop and yours start. This traces a single request across each boundary it crosses, covers the Trust Layer default most write-ups get wrong (LLM data masking is disabled for agents), and sets out what changes the moment a callout lands in your own account: retention, audit trail, and user identity that does not travel.

Apache Airflow on AWS: Building SaaS and API Pipelines That Don’t Lie to You

Post category:Cloud Computing DevOps Technical Guides

Most API pipeline failures are green DAGs producing incomplete data. A practical guide to running Apache Airflow on AWS for SaaS and API extraction: choosing between MWAA provisioned, MWAA Serverless and self-managed, the pool setting that silently stops throttling when you go deferrable, retry and pagination design, secrets handling, and the four cost lines that actually move.

Embedded Analytics on AWS: The Four Decisions That Bite Later

Post category:Cloud Computing DevOps Technical Guides

Rendering a dashboard inside your app is the easy part. Tenant isolation, session cost and query mode are what break. A practical walkthrough of the four decisions behind embedded analytics on AWS, the API constraints that lock you in, and the errors you will actually see.

Build a Secure AI Medical Assistant on AWS: The Boundaries That Actually Leak

Post category:Case Studies Cloud Computing DevOps Technical Guides

A practical architecture for a secure AI medical assistant on AWS, organised by the boundary the data crosses: the input box, your own invocation logs, cross-Region inference routing, the retrieval index, and clinical accuracy. Includes real commands, the failure modes that stay invisible until an audit, and the trade-offs worth knowing before you build.

A Secure-by-Default AWS Account Baseline in Terraform

Post category:Cloud Computing DevOps Web Security

A fresh AWS account ships wide open by default. Here are the seven decisions that make one defensible from the start — OIDC instead of static keys, encrypted state, an isolated database tier, free gateway endpoints — with a working Terraform reference implementation on GitHub.

HIPAA Compliance on AWS: The Gaps That Pass Every Security Check

Post category:Case Studies Cloud Computing Technical Guides Web Security

A working engineer's guide to HIPAA compliance on AWS, organised by the gap between the control you configured and the obligation you actually carry. Covers BAA account scope, the eligible services list as a contract boundary, KMS key policy versus the encryption checkbox, what "six years" really applies to, backup and restore scope, and the subprocessor chain nobody inventories.