The pipeline is the control
In a regulated environment a CI pipeline is not automation that happens to be convenient. It is the evidence that software reached production legitimately, and evidence has to outlive a log retention window.
Writing / tag
#security
Articles carrying this tag.
Security groups should describe relationships, not addresses
A rule written against a CIDR block encodes an accident of your current network. A rule written against another security group encodes what you actually meant.
Least privilege is a scheduling problem
Nobody argues against least privilege. It loses anyway, because a broad policy works in thirty seconds and a narrow one takes an afternoon, and the afternoon is never available.