Cloud Parts

Security

Who may sign in, and what they may touch.

6 concepts · 12 technologies

Concepts

Start with Authentication
  1. Authentication3 technologiesProving who a user is, before anyone decides what they may do.
  2. Identity & access (IAM)3 technologiesWho can do what, to which resource.
  3. Secrets management4 technologiesA locked vault for passwords, keys and tokens, handed out at runtime.
  4. Remote access3 technologiesHow people, scripts and AI agents reach private servers and databases without a public IP or a shared VPN.
  5. Common Vulnerabilities and Exposures (CVE)A public ID such as CVE-2021-44228 that names one known vulnerability, so every scanner, advisory and patch note can point at the same flaw.
  6. Threat detection (SIEM)2 technologiesCollecting security logs from many systems in one place and running detection rules over them, so that suspicious activity becomes an alert an analyst can act on.

Technologies

Grouped by the concept each one mainly implements

Worth exploring

All resources →
Article· March 2023The Great Lambda Migration to Kubernetes Jobs: a Journey in Three PartsLiav Yona, InfoQA first-person account of how Firefly moved event-driven work off Lambda (after hitting the 15-minute timeout), briefly onto ECS, and finally onto Kubernetes Jobs on EKS, with practical notes on reusing container images, swapping an IAM trust policy for EKS OIDC, moving environment variables into ConfigMaps and a blue/green cutover. It is one company’s story with few numbers, and the author’s employer sells infrastructure-as-code tooling, which colours the emphasis on IaC.
Article· August 2022Deploying AWS Lambda functions using AWS Controllers for Kubernetes (ACK)Rajdeep Saha, AWS Compute BlogAWS’s step-by-step tutorial for managing Lambda functions as Kubernetes custom resources: install the ACK Lambda controller in EKS, give it IAM permissions through IRSA, then kubectl apply a Function manifest that points at code in S3. It explains why you might (one GitOps and RBAC model for pods and functions) but, being AWS’s own post, not the drawbacks.
Article· May 2021Spice up Your Kubernetes Environment with AWS LambdaLiav Yona, MediumShows how a Lambda function triggered by SQS or SNS can forward events to an internal (ClusterIP) service in EKS through the Kubernetes API server’s service proxy, using IAM-to-RBAC mapping instead of exposing an endpoint, with code on GitHub. A clever pattern, but written for 2021-era EKS: it maps the IAM role through the aws-auth ConfigMap, and it routes application traffic through the cluster’s control plane.
WebsitePlatform tooling landscapePlatformEngineering.orgA filterable map of tools for building an internal developer platform. Each tool sits in one of five “planes” (developer control, integration and delivery, resource, observability, security) and a category such as IaC, CD pipeline, secrets or developer portal, with a one-line description. Vendors can submit their own tools, so treat it as a list of what exists rather than a ranking.