Search

Lessons (31)

• AWS Security Building Blocks

  … Give the running workload role permission to read only its required secret. KMS KMS manages encryption keys used …

• Providers and Your First AWS Resources

  … Separate resources manage public access, versioning, and encryption settings. bash terraform init terraform fmt terraform validate terraform plan …

• Multi-Account Strategy, Governance and Security Operations

  … isolate instance, disable key] Preventive controls checklist - Block public S3 access at the account level. - Enforce encryption (EBS …

• How a Web Request Works

  … You put the letter in a sealed envelope → TLS encryption (the "S" in HTTPS). 4. You write the …

• Production Capstone and Interview Practice

  … It creates a private, encrypted, versioned bucket with owner tags. It publishes bucket id and bucket arn . Move …

• State, Remote Backends, and Locking

  … Enable versioning, encryption, and public-access protection. Do not use the application bucket from lesson 5 as its …

• RBAC and Cluster Security

  … Enabling encryption at rest for Secrets in etcd (ideally with a KMS provider). 2. Restricting RBAC on secrets …

• AWS Interview Questions: Clear Answers

  … A publicly readable encrypted object is still publicly readable if access controls permit it. Example: keep Block Public …

• Domains, Load Balancers and HTTPS

  … An HTTPS listener encrypts the browser-to-ALB connection. If policy requires encryption to the backend too, configure …

• IAM: Who Can Do What

  … An encrypted object using a customer-managed KMS key can additionally require decrypt permission and an appropriate key …

• Storage Engines & Database Operations

  … Keep independent backups, define retention, encrypt them, and test restoring a realistic dataset into an isolated environment. Know …

• VPC Endpoints, Transit Gateway and Hybrid Networking

  … Overlaps are painful to fix later. Hybrid connectivity Option Notes --- --- Site-to-Site VPN Encrypted over the internet …

• Configuration, Secrets and Storage

  … shop-api-secrets Base64 encoding is not encryption . Never commit real secret values to Git. In production, store …

• IAM Deep Dive: Policy Evaluation, STS and Cross-Account Access

  … Check applicable organization controls and boundaries, plus resource policies and encryption permissions. 5. Configure a local role profile …

• Reusable Modules and Clear Interfaces

  … boundary A production storage module might always configure encryption, public-access protection, ownership tags, and versioning. Callers supply …

• S3: Store Files Safely

  … Resource": "arn:aws:s3:::shop-uploads/users/ " } Enable encryption and versioning for important data. Versioning makes accidental overwrites …

• Releases, Observability and Production Safety

  … Protect traffic with TLS, encrypt sensitive data at rest, rotate secrets, use least-privilege RBAC, and audit sensitive …

• Secrets, Ephemeral Values, and Least Privilege

  … in ordinary display Value may still be stored Encrypted remote state Protection of stored bytes Authorized readers can …

• Multi-Region and Disaster Recovery

  … discipline. A backup is unproven until restored Keep encrypted backups, document who can trigger failover, practice restoration, and …

• Practical Lab: S3 File Upload and CloudFront Delivery with NestJS

  … true,RestrictPublicBuckets=true Turn on default encryption (new buckets already encrypt with SSE-S3, this makes the setting …

• API Gateway, BFF & Service Discovery

  … Mesh gives you Without writing code --- --- 🔐 Mutual TLS Encrypted, authenticated service-to-service traffic 🔁 Retries, timeouts, circuit breaking …

• Internals, Upgrades, Resilience and Interview Questions

  … workload identity, Pod Security restricted , default-deny NetworkPolicies, encrypted and externalized secrets, image scanning and signing, admission policies …

• Scaling, Load Balancing & Rate Limiting

  … Use it when you need very high throughput, TCP or UDP support, end-to-end encryption, or protocol …

• Authentication, Authorization & API Security

  … Sflk… └── header ─────────┘ └── payload: { sub: "42", role: "admin", exp: … } ──────────┘ └ signature ┘ ⚠️ The payload is only Base64-encoded, not encrypted . Anyone …

• CQRS & Event Sourcing

  … Deleting" data (GDPR) with immutable events Crypto-shredding: encrypt personal data per user and delete the key Steeper …

• Resilience, Disaster Recovery and Multi-Region Design

  … Verify encryption keys, account permissions, images, configuration, and external integrations in the recovery environment. Exercise: Rehearse restoration using …

• Cost Optimization and the Well-Architected Framework

  … Security Is data and access protected? Least privilege, encryption, detection, incident response Reliability Does it recover from failure …

• AWS Data Pipelines in Plain Language

  … order AccessDenied Input bucket, result bucket, catalog, and encryption permissions Cleanup: dropping an external table removes metadata rather …

• AWS Databases: Choose the Right One

  … Use a supported engine version, appropriate storage, encryption, a backup retention policy, and an application database user with …

• Practical Project: Deploy a Real CRM App on EKS

  … class db.t4g.micro \ --allocated-storage 20 --storage-encrypted \ --master-username appadmin --manage-master-user-password \ --db-subnet …

• 500 Users Upload Documents at Once: Design the Background Job Pipeline

  … fleet with a shared rate limit Corrupt or encrypted PDF Mark failed immediately with a clear user-facing …