SaiJeevan Devireddy

If you signed up on Treatwise in the last 2-3 days, you might have noticed some technical issues completing your verification. We noticed all affected users and emailed them the next steps based on the specific issues each faced. Treatwise's IDP implementation is built on AWS Cognito. There are a couple of nuances Cognito doesn't handle out of the box, but we've augmented it with custom implementations — and going forward, you'll never face an issue past 30 minutes before we step in and help. As a health platform, trust isn't optional — it's the product. Every signup matters, every broken flow gets tracked, and every user gets a response. #startups #buildinpublic #ai #llm #saas #healthtech #innovation #technology

21

1 Comment

‼️ When AWS joined the Diwali celebrations 💥 Earlier today, a major outage in AWS US-EAST-1 (N. Virginia) rippled across the internet, disrupting popular apps like Snapchat 👻  and Fortnite 🔫. The core issue stemmed from a DNS resolution failure inside AWS’s internal network, a foundational service most other components rely on. This disruption cascaded into dependencies such as DynamoDB, Lambda, and EC2, which struggled to start or communicate with each other. While AWS engineers have stabilized DNS and recovery is ongoing, this incident underlines an important truth resilience isn’t just redundancy. Multi-AZ alone doesn’t guarantee continuity when a shared control-plane or internal service like DNS becomes the bottleneck. For architects, this is a nudge to revisit: 👉 Regional isolation boundaries. 👉 Independent failover paths for core infra dependencies. 👉 Simulations of control-plane failures, not just compute or storage. Incident Report ➡️ https://lnkd.in/gTqZFq-T #AWS #DevOps #SRE #CloudReliability #Diwali #IncidentResponse #AWSOutage

42

2 Comments

🚀 Simplifying Secrets Management in Amazon EKS with AWS Secrets Manager Agent🚀 Managing secrets securely in Kubernetes environments has always been a challenge — from language-specific SDK dependencies to complex secret rotations across multiple pods. In this newly published post by Sumanth Culli and Rakesh Shirke, AWS introduces a new approach — the AWS Secrets Manager Agent — that tackles these challenges head-on. 💡 Key Highlights: 🔹 Language-agnostic & lightweight: Retrieve secrets via a simple local HTTP endpoint (localhost:2773) — no SDK dependencies needed. 🔹 Improved availability: Secrets are fetched from an in-memory cache, reducing API calls and network latency. 🔹 Enhanced security: Built-in SSRF protection and Pod Identity authentication ensure secure secret retrieval without exposing credentials. 🔹 Post-quantum cryptography: Implements ML-KEM-based encryption for future-ready security. 🔹 Flexible deployment: Use as a sidecar container for isolated workloads or a DaemonSet for shared access. This solution complements the AWS Secrets and Configuration Provider (ASCP) for Kubernetes, offering a new path for teams who prefer HTTP-based secret access and dynamic refresh capabilities. 🔗 Read the full post to explore the implementation steps and choose the right approach for your EKS workloads: 👉 https://lnkd.in/gBC58D9p #AWS #EKS #Kubernetes #CloudSecurity #DevOps #AWSSecretsManager #Containers #CloudComputing #Security

18

Scaling S3 just got predictable: 𝗜𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝗶𝗻𝗴 𝗔𝗰𝗰𝗼𝘂𝗻𝘁-𝗟𝗲𝘃𝗲𝗹 𝗡𝗮𝗺𝗲𝘀𝗽𝗮𝗰𝗲𝘀 AWS just dropped a massive update for S3: A𝗰𝗰𝗼𝘂𝗻𝘁 𝗥𝗲𝗴𝗶𝗼𝗻𝗮𝗹 𝗡𝗮𝗺𝗲𝘀𝗽𝗮𝗰𝗲𝘀. If you’ve ever tried to create a bucket named 𝗽𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻𝗹𝗼𝗴𝘀 only to realize someone took that name in 2009, you know the struggle. For years, S3 bucket names had to be globally unique across all of AWS. It’s a "𝘀𝗺𝗮𝗹𝗹" change that solves a massive headache for Platform Engineers and Architects. #AWS #CloudComputing #S3 #DevOps #CloudArchitecture https://lnkd.in/eVZUAx8f

12

🎙IAM Learning Series 📖📖🙇‍♂️🙇‍♂️ 🔐 Myth vs Fact: Single Sign-On (SSO) Security 🚫 Myth: "Enabling SSO makes everything secure. Once it’s in place, no extra controls are needed." ✅ Fact: While SSO improves user convenience and reduces password fatigue, it can increase the attack surface if credentials are compromised. 👉 A single breach could unlock access to multiple applications. 👉 Sensitive and critical apps should have stricter conditional access policies (like MFA, device checks, risk-based access) even if they’re part of the SSO group. 💡 Smart Security Tip: SSO + layered conditional access = convenience and strong protection. #MythVsFact #CyberSecurity #SSO #IdentitySecurity #ConditionalAccess #ZeroTrust #cybersecurityawareness #identityandaccessmanagement #cybersecurityspeaker #Passionatespeaker #passion

11

2 Comments

Layoffs again. Amazon Web Services (AWS) is reportedly cutting another 30,000 jobs. Add that to their previous rounds, Microsoft’s, and the rest of the tech industry’s - layoffs have become a regular feature of work life over the past several decades. Headcount has become the most liquid asset on the balance sheet. The easiest lever to pull. And yet, the paradox is hard to ignore. We hear about companies wanting to hire and retain “the best and the brightest.” We hear about “employee engagement,” “commitment,” and “bringing your whole self to work.” Meanwhile, employees - myself included - have put our health, our families, and sometimes our sanity on hold in the name of delivery and dedication. I’ve done the late nights, the 80-hour weeks, the extensive business travel, the personal sacrifices. And for what? The people I performed those heroics for have long since moved on—retired, changed jobs, or forgotten. The managers who pushed hardest are gone. The toll, however, stays with you...and your family. I wish I had learned this earlier: - Work hard because it’s part of your character. - Keep learning because it keeps you sharp. - Be a great teammate and do excellent work—because that’s who you are. But don’t sacrifice your well-being for a company. Don’t let “work-life balance” be a corporate slogan instead of a personal boundary. I genuinely love working. I see it as a privilege—to use my gifts and skills to help others. But I’ve learned that work must have its place, its time, and its context. It cannot outbalance the rest of life. #CareerReflections #Leadership #WorkLifeBalance #Layoffs #TechIndustry

231

28 Comments

I just added support for AWS IAM Outbound Identity Federation to the Nymeria cross-cloud identity repository. Previously, AWS workloads required the target service to accept pre-signed Signature Version 4 headers for identity verification. This approach was not supported by Azure identity federation, so accessing Azure resources required an additional OIDC identity provider (for example, AWS EKS or Amazon Cognito) to issue tokens to AWS workloads. Now, with IAM Outbound Identity Federation, AWS workloads can request signed OIDC identity tokens (JWTs) using the sts:GetWebIdentityToken API. These identity tokens enable OIDC federation into external cloud services. This blog post demonstrates how to use AWS IAM Outbound Identity Federation to access data hosted in Azure Storage: https://lnkd.in/gcatS7FU GitHub repository: https://lnkd.in/gZHJg8cj

50

🔐 If your Amazon Web Services (AWS) security model still trusts “inside the VPC = trusted”- this read is for you. Most cloud breaches don’t happen because of zero-days. They happen because something inside the perimeter was trusted way too much. After seeing too many AWS environments still “trust the VPC,” I wrote down a technical article on what Zero Trust actually looks like in production on AWS — from identity to data to detection. Inside the article: • Why identity is the real perimeter on AWS ? • How to stop lateral movement between services ? • What micro-segmentation looks like without over engineering ? • How Zero Trust can actually reduce cost, not increase it ? This isn’t about adding more tools. It’s about designing systems that assume compromise — and limit the blast radius when it happens. If you’re building or reviewing: ✅ SaaS platforms ✅ Multi-account AWS environments ✅ Regulated or customer-data workloads …this model is becoming table stakes. 📖 Read the full breakdown here → https://lnkd.in/eUiXDPrA Am curious now 🤔 What’s the weakest trust assumption in your current AWS setup? #AWS #ZeroTrust #CloudSecurity #CloudArchitecture #DevSecOps #PlatformEngineering

13

Nice, you can now enforce S3 block public access settings across the entire AWS organization by attaching an S3 policy to any part of the organization. It's important to note that this org-wide setting overrides the account-level settings. I wonder if there are tricky edge cases where an account needs to be part of an OU, but it clashes with the S3 policy applied to the OU. e.g. a "prod" OU encompasses all the prod workload accounts and has an S3 policy that blocks public access for all S3 buckets. But one account needs a publicly accessible S3 bucket (maybe to hols some simple frontend code). Maybe you need to carve out an exception in the S3 policy itself? Or move the account out of that OU, which would be problematic because other SCPs and RCPs on that OU is still relevant. I wonder how you'd deal with this kind of situation? 🤔 Announcement: https://lnkd.in/ef8q7vk3 Developer guide for more detial: https://lnkd.in/ej6FbBc5

74

10 Comments

AWS US-East-1 Region Outage: Is the compliance juice worth the engineering squeeze? For all my Governance, Risk, and Compliance/Auditor peers who are asking their organizations to go multi-region or multi-cloud because it's a compliance best practice, please be mindful of the costs and the level of engineering effort this entails. Is the compliance juice actually worth the engineering squeeze? As examples, instead of defaulting to “go multi-region”, ask yourself: What’s our actual SLA? Does it encompass both failures from our providers, AND failures from our own bad code? What’s our tolerance for downtime, and how much does it cost us both in customer trust, AND dollars? What would going multi-region / multi-cloud have cost us in time and engineering effort over the last few years? My request - Use this incident as an opportunity to align yourself with your engineering organization, and build alliances by suggesting practical mitigation strategies, instead of berating others "because compliance said so." (h/t Arjay McCandless)

18

2 Comments

A senior professional with 15+ years of experience in monitoring tools like Nagios, SolarWinds, and Datadog reached out to me and asked: “Is Splunk good for me? I have heavy experience in monitoring, but I’m in dilemma about what to do…” And this was my honest reply 👇 - Splunk can absolutely be an added advantage - but only if you’re ready to spend time learning it the right way. - If you don’t have time for hands-on practice and real-time implementation, then it’s better to strengthen what you already know rather than jumping into Splunk out of fear of missing out. Let me be transparent: - Learning Splunk is not about finishing a few videos or certifications. - It’s about building real-time understanding - from architecture, data onboarding, search, and dashboards to troubleshooting. - It takes time - at least 5–6 months of consistent, focused effort. Many professionals today feel stuck because they rush to “add a tool” to their resume… but forget to build the depth needed to explain and apply it confidently in interviews or production. So, if you’re planning to learn Splunk, do it not out of fear, but out of curiosity and purpose. That’s the only way it truly transforms your career. 🌱

39

Continuing to sharpen my cloud expertise one lesson at a time — whether it’s diving deeper into architecture best practices, brushing up on AWS cost optimization, or exploring new services, the small steps really add up. Staying consistent with learning not only boosts technical skills but also builds confidence to tackle real-world challenges. How do you usually kickstart your mornings? 🌍☕ #AWS #SkillBuilder #CloudEngineering #ContinuousLearning #GrowthMindset

8

We audited 37 Kubernetes clusters. 90% had no pod security policies. Most teams think they’re “secure” because they run EKS or GKE with RBAC and some CIS benchmarks sprinkled in. But here’s what we found when we dug deeper: 1. 𝐑𝐨𝐨𝐭 𝐞𝐯𝐞𝐫𝐲𝐰𝐡𝐞𝐫𝐞. Containers running as root by default. From sidecars to batch jobs (no user restrictions). One vulnerable image, and you’re handing the attacker root access to your node. 2. 𝐍𝐨 𝐫𝐞𝐚𝐝𝐎𝐧𝐥𝐲𝐑𝐨𝐨𝐭𝐅𝐢𝐥𝐞𝐬𝐲𝐬𝐭𝐞𝐦. Most teams didn’t even know this was a thing. Write access inside containers = perfect place to drop malware, shells, crypto miners (undetected). 3. 𝐏𝐫𝐢𝐯𝐢𝐥𝐞𝐠𝐞𝐝 𝐩𝐨𝐝𝐬 𝐰𝐢𝐭𝐡 𝐧𝐨 𝐣𝐮𝐬𝐭𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧. Dozens of workloads running with full host access. When we asked “Why?”, the answer: "That's how the Helm chart came out of the box." 4. 𝐏𝐒𝐏 𝐝𝐞𝐩𝐫𝐞𝐜𝐚𝐭𝐞𝐝. 𝐍𝐨𝐭𝐡𝐢𝐧𝐠 𝐫𝐞𝐩𝐥𝐚𝐜𝐞𝐝 𝐢𝐭. K8s deprecated PodSecurityPolicy. Cool. But barely anyone had adopted OPA Gatekeeper, Kyverno, or admission controllers to fill the gap. Their plan? “Yeah… we’ve been meaning to look into that.” 5. 𝐍𝐨 𝐝𝐞𝐟𝐚𝐮𝐥𝐭 𝐝𝐞𝐧𝐲. 𝐍𝐨 𝐟𝐚𝐥𝐥𝐛𝐚𝐜𝐤. 𝐍𝐨 𝐚𝐮𝐝𝐢𝐭 𝐥𝐨𝐠𝐬. Most clusters had no baseline security controls. If a pod wants host access, node access, or wide network permissions (it just gets it). Nobody’s watching. 𝐇𝐞𝐫𝐞'𝐬 𝐭𝐡𝐞 𝐩𝐚𝐫𝐭 𝐧𝐨𝐛𝐨𝐝𝐲 𝐭𝐞𝐥𝐥𝐬 𝐲𝐨𝐮: RBAC and cloud IAM are useless if the pod is already compromised. And without security policies, every pod is a potential backdoor with root access. We’ve helped 50+ teams lock this down without breaking deployments or slowing devs. Want the exact checklist we use to audit and secure clusters? Comment "Secure my cluster" or DM me. ♻️ 𝐑𝐄𝐏𝐎𝐒𝐓 𝐒𝐨 𝐎𝐭𝐡𝐞𝐫𝐬 𝐂𝐚𝐧 𝐋𝐞𝐚𝐫𝐧.

31

4 Comments