GitHub Actions OIDC Trust Policy for AWS
GitHub now issues two OIDC subject formats. Here is a trust policy that accepts both, a way to prove it against every repository, and a safe order for retiring keys.
AWS15 min read
Blog
Notes from building and running backends, cloud platforms and AI products in production. Each post starts from something real: a migration that went sideways, a design that held up under load, a cost that surprised everyone.
Written for engineers who want the specifics, with a clear takeaway for the managers and founders who have to make the call.
SCP vs RCP vs Declarative Policies in AWS
Deny a verb or assert a state? A practical guide to choosing between SCPs, RCPs and declarative policies, with examples and a safe rollout checklist.
AWS13 min read
Move an AWS Account to Another Organization
The order of operations for moving an AWS account between organizations: invite from the destination, enroll in Control Tower, then close the sign-on, guardrail and old-role gaps.
AWS12 min read