— security first cloud · aws
security, before
the first resource.
security is a day-0 property, not a day-N project. you set the defaults before the first real resource exists, or you inherit debt you never fully pay down. this is the groundwork, in the order you actually do it: the root of trust, least privilege, deny by default, then the record of who did what.
a build log, and an honest one. most of this is running; the part almost everyone skips until after an incident, a durable record you can actually query, is built here in the open, and the last part is a plain scorecard of what is solid and what is still a gap.
the series · 8 parts
- 01→Secure the State Before You Secure Anything Else2026-03-15
The first thing that should exist in a new cloud account is an encrypted, versioned, lock-protected record of what you built, because everything after it depends on that record being intact.
- 02→Least Privilege Starts at Resource One2026-03-29
Every workload should run as its own minimal identity and no machine should carry a long-lived key, starting from the very first resource rather than as cleanup later.
- 03→Deny by Default: Nothing Is Reachable Unless You Say So2026-04-12
Make everything private by default and reachable only through a single controlled front door, so that access is something you grant deliberately rather than something you forgot to remove.
- 04→The More You Log, the More You Leak2026-04-26
Treat encryption at rest as a default rather than a feature, and decide deliberately what your logs must never record, because verbose observability is also a fast path to leaking the secrets you were trying to protect.
- 05→Before the First Incident Asks, Write Down Who Did What2026-05-10
The account-wide audit trail is the one control almost everyone turns on the day after an incident, so turn it on before you need it.
- 06→An Audit Trail You Cannot Question Is a Receipt You Never Read2026-05-24
Route the audit trail into durable storage and put a query layer over it so you can ask your own history a question instead of scrolling a console.
- 07→Know When It Breaks, and Guardrails That Survive a Mistake2026-06-07
Alerting tells you after something goes wrong, guardrails stop the mistake, and being honest about which one you actually have is the point.
- 08→The Honest Scorecard: What Day 0 Covered and What It Did Not2026-06-21
What is genuinely day-0-solid, what is still a gap, and what security-first actually costs in time and money when you add it up.
the same day-0 decisions, the other way, are in Security First Cloud: GCP. the rest of the writing lives in the garden.