GitHub Actions OIDC Trust Policy for AWS
GitHub now issues two OIDC subject formats. Here is a trust policy that accepts both, a way to prove it against every repository, and a safe order for retiring keys.
AWS15 min read
DevOps
SCP vs RCP vs Declarative Policies in AWS
Deny a verb or assert a state? A practical guide to choosing between SCPs, RCPs and declarative policies, with examples and a safe rollout checklist.
AWS13 min read
Move an AWS Account to Another Organization
The order of operations for moving an AWS account between organizations: invite from the destination, enroll in Control Tower, then close the sign-on, guardrail and old-role gaps.
AWS12 min read