Permissions Boundaries | John Nessime

AI-Generated IAM Policies: Where the Hard Boundary Belongs

Post category:Cloud Computing Cloud Security DevOps

A generated policy with no wildcards can still hand over your account. Here are the three failure shapes that survive human review, why the review step is the wrong place to put your defence, and how to build a ceiling that holds regardless of what the model writes.

Twenty Client AWS Accounts and Not One Shared Admin Credential

Post category:Cloud Computing Cloud Security DevOps

Shared admin credentials work right up until someone resigns or an auditor asks who did what. Here's how to design client AWS account access around cross-account roles, unique external IDs and per-engineer attribution, so twenty accounts need zero shared keys and revocation is one action.