https://tocconsulting.fr/blog Practitioner-level articles on AWS security and cloud architecture from Toc Consulting. en-us Tue, 23 Jun 2026 12:00:00 GMT scripts/generate-blog-rss.mjs https://tocconsulting.fr/logos/og-image.png https://tocconsulting.fr/blog https://tocconsulting.fr/blog/chaos-engineering-running-a-program https://tocconsulting.fr/blog/chaos-engineering-running-a-program Tue, 23 Jun 2026 12:00:00 GMT One experiment is a demo. A program is what builds resilience. Turn FIS experiments into an ongoing practice: the resilience flywheel, GameDays, continuous automated chaos on a schedule and in CI/CD, and AWS Resilience Hub. Includes a real, validated EventBridge Scheduler setup and the jsonencode gotcha that makes a recurring schedule silently run only once. https://tocconsulting.fr/blog/chaos-engineering-multi-region-dr https://tocconsulting.fr/blog/chaos-engineering-multi-region-dr Mon, 22 Jun 2026 12:00:00 GMT Stop talking about disaster recovery and measure it. Pause DynamoDB global table replication with AWS FIS while a live two-Region application keeps writing, then count exactly how many records the surviving Region cannot see. Real Terraform, real RPO, real recovery time. https://tocconsulting.fr/blog/chaos-engineering-containers-and-serverless https://tocconsulting.fr/blog/chaos-engineering-containers-and-serverless Fri, 19 Jun 2026 12:00:00 GMT Leave EC2 behind. Stop a whole Fargate task set and force AWS Lambda invocations to error and to stall, using AWS FIS. Real Terraform, real numbers, and the exact setup gotchas for the Lambda fault-injection extension. https://tocconsulting.fr/blog/chaos-engineering-dependency-and-api-faults https://tocconsulting.fr/blog/chaos-engineering-dependency-and-api-faults Thu, 18 Jun 2026 12:00:00 GMT Sever the DynamoDB and S3 endpoints an application quietly depends on, using AWS FIS, and watch whether one dependency outage stays contained or takes the whole app down. Real Terraform, real per-endpoint numbers. https://tocconsulting.fr/blog/chaos-engineering-availability-zone-failure https://tocconsulting.fr/blog/chaos-engineering-availability-zone-failure Wed, 17 Jun 2026 12:00:00 GMT Take down an entire Availability Zone with AWS FIS: stop every instance in it, blackhole its subnet, and fail Aurora over. See whether a multi-AZ architecture really survives, and the roughly two-minute window that static stability does not erase. https://tocconsulting.fr/blog/chaos-engineering-stress-and-network-faults https://tocconsulting.fr/blog/chaos-engineering-stress-and-network-faults Tue, 16 Jun 2026 12:00:00 GMT Inject CPU stress, memory pressure, network latency, and packet loss into a whole EC2 fleet with AWS FIS. Watch network faults turn a healthy service into 7-second page loads while every error dashboard stays green. Real Terraform, real numbers. https://tocconsulting.fr/blog/chaos-engineering-graceful-degradation https://tocconsulting.fr/blog/chaos-engineering-graceful-degradation Mon, 15 Jun 2026 12:00:00 GMT When the database is completely gone, RDS Proxy and retries cannot help. Survive an extended Aurora outage with a circuit breaker, a DynamoDB read cache, and SQS write buffering. Real Terraform, real outage, real numbers. https://tocconsulting.fr/blog/chaos-engineering-database-resilience https://tocconsulting.fr/blog/chaos-engineering-database-resilience Fri, 12 Jun 2026 12:00:00 GMT Force an Aurora failover with AWS FIS and watch your application break. Then fix it with RDS Proxy, read/write separation, and retry logic. Real Terraform code, real experiment results. https://tocconsulting.fr/blog/chaos-engineering-observability-first https://tocconsulting.fr/blog/chaos-engineering-observability-first Thu, 11 Jun 2026 12:00:00 GMT Add CloudWatch dashboards, alarms, and FIS stop conditions to your chaos engineering lab. See how guardrails automatically abort experiments when things go wrong. https://tocconsulting.fr/blog/chaos-engineering-what-is-chaos https://tocconsulting.fr/blog/chaos-engineering-what-is-chaos Wed, 10 Jun 2026 12:00:00 GMT A hands-on introduction to chaos engineering on AWS. Deploy a product catalog API backed by Aurora, then break it with AWS Fault Injection Service to find the gap between your architecture diagram and reality. https://tocconsulting.fr/blog/application-layer-lambda-security https://tocconsulting.fr/blog/application-layer-lambda-security Tue, 09 Jun 2026 12:00:00 GMT Part 4 of 4 in the Lambda Security Series. The half no posture scanner reaches: event-data injection, stealable execution-role credentials, insecure deserialization, dependency and code scanning, runtime secrets, and detection. https://tocconsulting.fr/blog/lambda-compliance-and-remediation https://tocconsulting.fr/blog/lambda-compliance-and-remediation Thu, 04 Jun 2026 12:00:00 GMT Part 3 of 4 in the Lambda Security Series. Map every Lambda security finding to ten compliance frameworks (PCI DSS, HIPAA, SOC 2, ISO 27001, NIST, GDPR), then fix each of the 19 checks with a precise AWS CLI command. https://tocconsulting.fr/blog/inside-lambda-security-scanner https://tocconsulting.fr/blog/inside-lambda-security-scanner Sat, 30 May 2026 12:00:00 GMT Part 2 of 4 in the Lambda Security Series. A deep look at lambda-security-scanner: 19 read-only checks across configuration, access control, network, logging, and supply chain, scored 0 to 100 and mapped to ten compliance frameworks. https://tocconsulting.fr/blog/state-of-aws-lambda-security-2026 https://tocconsulting.fr/blog/state-of-aws-lambda-security-2026 Mon, 25 May 2026 12:00:00 GMT Serverless does not mean secure. The real AWS Lambda attack surface in 2026: overprivileged IAM roles, secrets in env vars, public function URLs, deprecated runtimes, and event injection. https://tocconsulting.fr/blog/ollama-local-ai-aws-security https://tocconsulting.fr/blog/ollama-local-ai-aws-security Mon, 30 Mar 2026 12:00:00 GMT Stop sending your IAM policies, CloudTrail logs, and infrastructure code to third-party APIs. Run LLMs locally with Ollama on Apple Silicon: private, offline, fast. Complete setup guide with AWS security use cases. https://tocconsulting.fr/blog/litellm-supply-chain-anatomy https://tocconsulting.fr/blog/litellm-supply-chain-anatomy Wed, 25 Mar 2026 12:00:00 GMT A deep technical breakdown of how threat actor TeamPCP compromised Trivy, pivoted to LiteLLM, and turned a popular AI proxy into a credential-stealing weapon targeting AWS IMDS, Secrets Manager, and Kubernetes. https://tocconsulting.fr/blog/aws-security-cards-announcement https://tocconsulting.fr/blog/aws-security-cards-announcement Tue, 17 Mar 2026 12:00:00 GMT Free, open-source security reference cards covering attack vectors, misconfigurations, enumeration commands, privilege escalation, persistence, detection, and defense for 60 AWS services. https://tocconsulting.fr/blog/aws-community-builder-announcement https://tocconsulting.fr/blog/aws-community-builder-announcement Fri, 06 Mar 2026 12:00:00 GMT A thank you to my readers, and a call to support open source AWS tools. https://tocconsulting.fr/blog/awsmap-v150-your-aws-inventory-now-has-a-brain https://tocconsulting.fr/blog/awsmap-v150-your-aws-inventory-now-has-a-brain Thu, 26 Feb 2026 12:00:00 GMT A few weeks ago I published awsmap. Scan your AWS account. 140 services. One command. This is v1.5.0 with SQLite storage, natural language queries, pre-built security audits, and multi-account support. https://tocconsulting.fr/blog/aws-security-audit-checklist https://tocconsulting.fr/blog/aws-security-audit-checklist Tue, 10 Feb 2026 12:00:00 GMT A comprehensive AWS security audit checklist covering IAM, S3, networking, logging, and compliance. Follow this step-by-step guide to secure your AWS infrastructure. https://tocconsulting.fr/blog/aws-iam-best-practices https://tocconsulting.fr/blog/aws-iam-best-practices Thu, 05 Feb 2026 12:00:00 GMT Learn the essential AWS IAM best practices to secure your cloud environment. Covers least privilege, MFA, roles, policies, and access management strategies. https://tocconsulting.fr/blog/awsmap-resource-discovery https://tocconsulting.fr/blog/awsmap-resource-discovery Sun, 01 Feb 2026 12:00:00 GMT A CLI tool that scans 140+ AWS services across all regions in about 130 seconds, generating HTML, JSON, or CSV inventory reports for audits, cost analysis, and security reviews. https://tocconsulting.fr/blog/aws-arsenal-ep5-load-balancer https://tocconsulting.fr/blog/aws-arsenal-ep5-load-balancer Thu, 29 Jan 2026 12:00:00 GMT Audit all AWS load balancers across regions in one command. Detect HTTP listeners on public ALBs, outdated TLS policies, unhealthy targets, and insecure configurations. https://tocconsulting.fr/blog/aws-s3-security-guide https://tocconsulting.fr/blog/aws-s3-security-guide Wed, 28 Jan 2026 12:00:00 GMT Complete guide to securing your AWS S3 buckets. Learn how to prevent data leaks with bucket policies, encryption, access controls, and monitoring. https://tocconsulting.fr/blog/cryptex-cli-tool https://tocconsulting.fr/blog/cryptex-cli-tool Tue, 27 Jan 2026 12:00:00 GMT A CLI tool that generates cryptographically secure passwords with compliance templates, .env file generation, secret manager integration, and TOTP support. https://tocconsulting.fr/blog/aws-compliance-guide https://tocconsulting.fr/blog/aws-compliance-guide Tue, 20 Jan 2026 12:00:00 GMT Navigate AWS compliance requirements for HIPAA, GDPR, PCI DSS, and SOC 2. Learn which AWS services help you meet regulatory obligations. https://tocconsulting.fr/blog/s3-security-why-it-matters https://tocconsulting.fr/blog/s3-security-why-it-matters Thu, 15 Jan 2026 12:00:00 GMT Part 1 of the S3 Security Series. Explore the major S3 data breaches of the past decade and why Amazon S3 security matters more than most people realize. https://tocconsulting.fr/blog/s3-security-22-checks https://tocconsulting.fr/blog/s3-security-22-checks Wed, 14 Jan 2026 12:00:00 GMT Part 2 of the S3 Security Series. Learn the 22 critical security checks every S3 bucket needs, mapped to 9 compliance frameworks including CIS, PCI-DSS, and HIPAA. https://tocconsulting.fr/blog/s3-security-scanner-open-source https://tocconsulting.fr/blog/s3-security-scanner-open-source Wed, 14 Jan 2026 12:00:00 GMT Part 3 of the S3 Security Series. Learn about the open-source S3 Security Scanner tool that automates 22 security checks, DNS takeover detection, and bucket discovery. https://tocconsulting.fr/blog/iam-activity-tracker https://tocconsulting.fr/blog/iam-activity-tracker Mon, 12 Jan 2026 12:00:00 GMT A serverless IAM activity monitoring tool that tracks IAM, STS, and console signin events across all AWS regions with real-time security alerts and long-term analytics. https://tocconsulting.fr/blog/s3-security-remediation-guide https://tocconsulting.fr/blog/s3-security-remediation-guide Mon, 12 Jan 2026 12:00:00 GMT Part 4 of the S3 Security Series. Step-by-step remediation for critical S3 security issues with AWS Console, CLI, and Python boto3 examples. https://tocconsulting.fr/blog/aws-security-updates-2025 https://tocconsulting.fr/blog/aws-security-updates-2025 Sat, 20 Dec 2025 12:00:00 GMT The most impactful AWS security changes in 2025: SCPs got full IAM language support, GuardDuty detects multi-stage attacks, Inspector expanded to SAST and IaC, post-quantum cryptography arrived, and HashiCorp deprecated CDKTF. https://tocconsulting.fr/blog/aws-arsenal-ep2-mfa-scanner https://tocconsulting.fr/blog/aws-arsenal-ep2-mfa-scanner Wed, 03 Sep 2025 12:00:00 GMT Build an automated MFA compliance scanner that identifies IAM users with console access but no MFA enabled, with risk-based prioritization and Lambda monitoring. https://tocconsulting.fr/blog/aws-arsenal-ep3-rds-detective https://tocconsulting.fr/blog/aws-arsenal-ep3-rds-detective Wed, 03 Sep 2025 12:00:00 GMT Build automated scanners that identify publicly accessible RDS databases, analyze security groups, check encryption, and generate remediation commands across all AWS regions. https://tocconsulting.fr/blog/aws-arsenal-ep4-s3-exposure https://tocconsulting.fr/blog/aws-arsenal-ep4-s3-exposure Wed, 03 Sep 2025 12:00:00 GMT Detect and remediate exposed S3 buckets by analyzing ACLs, bucket policies, public access blocks, and website hosting configurations with automated scanning tools. https://tocconsulting.fr/blog/aws-arsenal-ep1-lambda-runtimes https://tocconsulting.fr/blog/aws-arsenal-ep1-lambda-runtimes Mon, 01 Sep 2025 12:00:00 GMT Learn how to systematically identify Lambda functions running on deprecated runtimes across all AWS regions with CLI and Lambda automation tools. https://tocconsulting.fr/blog/aws-security-arsenal-introduction https://tocconsulting.fr/blog/aws-security-arsenal-introduction Mon, 01 Sep 2025 12:00:00 GMT Introducing a 14-episode series of production-ready AWS security and cost optimization scripts. Each tool comes as both a CLI version and a Lambda version for automated monitoring. https://tocconsulting.fr/blog/netflix-cloud-architecture https://tocconsulting.fr/blog/netflix-cloud-architecture Wed, 30 Jul 2025 12:00:00 GMT The story of Netflix's historic 7-year cloud migration to AWS and the microservices architecture that powers global streaming for 300+ million subscribers. https://tocconsulting.fr/blog/aws-sam-python-guide https://tocconsulting.fr/blog/aws-sam-python-guide Tue, 15 Jul 2025 12:00:00 GMT A complete beginner-to-builder guide for AWS SAM with Python. Learn to create, test locally, deploy, debug, and manage serverless APIs step by step. https://tocconsulting.fr/blog/cloud-computing-revolution https://tocconsulting.fr/blog/cloud-computing-revolution Tue, 08 Jul 2025 12:00:00 GMT From forgotten USB drives to the cloud revolution: how Drew Houston's bus ride and Amazon S3's launch changed computing forever, validated by Instagram's $1B acquisition. https://tocconsulting.fr/blog/serverless-file-sharing https://tocconsulting.fr/blog/serverless-file-sharing Tue, 08 Jul 2025 12:00:00 GMT How I built a secure, scalable file sharing solution using AWS Lambda, API Gateway, and Cognito with zero infrastructure to manage and 91% cost reduction. https://tocconsulting.fr/blog/serverless-auth-api https://tocconsulting.fr/blog/serverless-auth-api Sun, 06 Jul 2025 12:00:00 GMT How I built CognitoApi, an open-source serverless authentication API on AWS Cognito that handles 50,000 users for free with MFA, token management, and complete user lifecycle support. https://tocconsulting.fr/blog/architecture-patterns https://tocconsulting.fr/blog/architecture-patterns Mon, 23 Jun 2025 12:00:00 GMT Six production-proven AWS architecture patterns: three-tier web apps, serverless APIs, event-driven processing, static websites, data lakes, and multi-region disaster recovery with diagrams and implementation guides. https://tocconsulting.fr/blog/cost-optimization https://tocconsulting.fr/blog/cost-optimization Mon, 16 Jun 2025 12:00:00 GMT Complete guide to AWS cost optimization covering Cost Explorer, Compute Optimizer, Savings Plans, Spot Instances, S3 lifecycle policies, gp2 to gp3 migration, scheduling, budgets, and production best practices. https://tocconsulting.fr/blog/ai-ml-services https://tocconsulting.fr/blog/ai-ml-services Mon, 09 Jun 2025 12:00:00 GMT Complete guide to AWS AI services including Rekognition, Comprehend, Textract, Polly, Translate, Transcribe, and Bedrock with CLI commands, pricing, and production best practices. https://tocconsulting.fr/blog/cloudfront-cdn-speed https://tocconsulting.fr/blog/cloudfront-cdn-speed Mon, 02 Jun 2025 12:00:00 GMT Complete guide to Amazon CloudFront covering S3 origins with OAC, cache policies, path-based routing, origin failover, CloudFront Functions, Lambda@Edge, WAF, signed URLs, invalidation, pricing, and monitoring. https://tocconsulting.fr/blog/sqs-sns-messaging https://tocconsulting.fr/blog/sqs-sns-messaging Mon, 26 May 2025 12:00:00 GMT Complete guide to Amazon SQS and SNS covering standard and FIFO queues, dead-letter queues, SNS fan-out, message filtering, Lambda integration, encryption, pricing, and event-driven architecture patterns. https://tocconsulting.fr/blog/eks-kubernetes-aws https://tocconsulting.fr/blog/eks-kubernetes-aws Mon, 19 May 2025 12:00:00 GMT Complete guide to Amazon EKS covering cluster creation with eksctl, managed node groups, Fargate on EKS, Kubernetes manifests, IRSA, EKS Pod Identity, AWS Load Balancer Controller, Karpenter autoscaling, and the ECS vs EKS decision guide. https://tocconsulting.fr/blog/ecs-production-patterns https://tocconsulting.fr/blog/ecs-production-patterns Mon, 12 May 2025 12:00:00 GMT Production patterns for Amazon ECS covering rolling updates, blue-green deployments with CodeDeploy, auto-scaling, Fargate Spot, secrets management, CI/CD pipelines, AWS Batch, and cost optimization. https://tocconsulting.fr/blog/containers-ecs-fargate https://tocconsulting.fr/blog/containers-ecs-fargate Mon, 05 May 2025 12:00:00 GMT Complete guide to running containers on AWS with ECR, ECS, and Fargate. Covers task definitions, services, networking, load balancing, IAM roles, service discovery, logging, and CloudFormation deployment. https://tocconsulting.fr/blog/cloudwatch-monitoring-deep-dive https://tocconsulting.fr/blog/cloudwatch-monitoring-deep-dive Mon, 28 Apr 2025 12:00:00 GMT Complete guide to Amazon CloudWatch covering metrics, alarms, Logs Insights, CloudWatch Agent, dashboards, anomaly detection, Synthetics, Container Insights, X-Ray tracing, EMF, and cost optimization. https://tocconsulting.fr/blog/api-gateway-deep-dive https://tocconsulting.fr/blog/api-gateway-deep-dive Mon, 21 Apr 2025 12:00:00 GMT Complete guide to Amazon API Gateway covering REST API vs HTTP API, Lambda integration, authorization, custom domains, throttling, caching, WebSocket APIs, and production best practices. https://tocconsulting.fr/blog/dynamodb-deep-dive https://tocconsulting.fr/blog/dynamodb-deep-dive Mon, 14 Apr 2025 12:00:00 GMT Complete guide to Amazon DynamoDB covering data modeling, primary keys, secondary indexes, capacity modes, transactions, streams, global tables, DAX caching, and production best practices. https://tocconsulting.fr/blog/rds-database-deep-dive https://tocconsulting.fr/blog/rds-database-deep-dive Mon, 07 Apr 2025 12:00:00 GMT Complete guide to Amazon RDS and Aurora covering supported engines, Multi-AZ deployments, read replicas, backups, security, monitoring, Aurora architecture, and production best practices. https://tocconsulting.fr/blog/s3-storage-deep-dive https://tocconsulting.fr/blog/s3-storage-deep-dive Mon, 31 Mar 2025 12:00:00 GMT Complete guide to Amazon S3 covering the object model, storage classes, security, encryption, lifecycle policies, replication, performance optimization, and cost management. https://tocconsulting.fr/blog/lambda-serverless https://tocconsulting.fr/blog/lambda-serverless Mon, 24 Mar 2025 12:00:00 GMT Complete guide to AWS Lambda covering the execution model, deployment options, triggers, cold starts, concurrency, pricing, and production architecture patterns. https://tocconsulting.fr/blog/ec2-networking-security https://tocconsulting.fr/blog/ec2-networking-security Mon, 17 Mar 2025 12:00:00 GMT Master EC2 networking and security. Learn VPCs, subnets, security groups, NACLs, NAT gateways, VPC endpoints, SSH hardening, load balancers, and defense-in-depth architecture. https://tocconsulting.fr/blog/ec2-instance-types https://tocconsulting.fr/blog/ec2-instance-types Mon, 10 Mar 2025 12:00:00 GMT Master EC2 instance type selection. Learn instance families, burstable instances and CPU credits, purchasing options, enhanced networking, placement groups, and right-sizing strategies. https://tocconsulting.fr/blog/ec2-getting-started https://tocconsulting.fr/blog/ec2-getting-started Mon, 03 Mar 2025 12:00:00 GMT Step-by-step guide to launching, configuring, and managing your first Amazon EC2 instance, covering instance types, security groups, key pairs, SSH access, web server setup, monitoring, and cost management. https://tocconsulting.fr/blog/vault-production-deployment https://tocconsulting.fr/blog/vault-production-deployment Mon, 24 Feb 2025 12:00:00 GMT Complete guide to deploying HashiCorp Vault in production on AWS with Terraform, KMS auto-unseal, Raft storage, TLS, load balancing, auto scaling, monitoring, and backup strategies. https://tocconsulting.fr/blog/vault-auth-python-integration https://tocconsulting.fr/blog/vault-auth-python-integration Mon, 17 Feb 2025 12:00:00 GMT Deep dive into Vault authentication methods including AppRole and AWS IAM auth, with a complete Python application that uses dynamic AWS credentials transparently. https://tocconsulting.fr/blog/hashicorp-vault-aws https://tocconsulting.fr/blog/hashicorp-vault-aws Mon, 10 Feb 2025 12:00:00 GMT Understanding HashiCorp Vault, why traditional credential management is broken, how dynamic secrets work, and hands-on setup of the AWS secrets engine with role-based credential generation. https://tocconsulting.fr/blog/iam-access-keys-management https://tocconsulting.fr/blog/iam-access-keys-management Mon, 03 Feb 2025 12:00:00 GMT Enterprise-grade strategies for AWS credential lifecycle management including rotation automation, monitoring, Secrets Manager, and compliance reporting. https://tocconsulting.fr/blog/iam-roles-cross-account https://tocconsulting.fr/blog/iam-roles-cross-account Mon, 27 Jan 2025 12:00:00 GMT Complete guide to AWS IAM roles covering trust policies, cross-account architecture, service roles, SAML/OIDC federation, and the confused deputy problem. https://tocconsulting.fr/blog/iam-policies-mastery https://tocconsulting.fr/blog/iam-policies-mastery Mon, 20 Jan 2025 12:00:00 GMT Deep dive into AWS IAM policies covering policy types, evaluation logic, condition keys, advanced patterns, and common pitfalls with real-world examples. https://tocconsulting.fr/blog/iam-fundamentals-beginners https://tocconsulting.fr/blog/iam-fundamentals-beginners Mon, 13 Jan 2025 12:00:00 GMT A practical guide to AWS Identity and Access Management covering users, groups, roles, and policies with hands-on Python examples. https://tocconsulting.fr/blog/aws-developer-setup-python https://tocconsulting.fr/blog/aws-developer-setup-python Mon, 06 Jan 2025 12:00:00 GMT A practical guide to configuring AWS CLI v2, Boto3, and secure credential management for professional cloud development.