Agentic AI & Cloud Security

Nash Ogden

Published articles: 53

Agentic AI & Cloud Security

View LinkedIn profile

Articles (53) — Page 2

AWS KMS Encryption Architecture (2026): The Per-Tenant CMK Trap, the 10,000 req/s Shared Quota, and When AWS-Owned Keys Win

Security & Compliance

Jun 4, 20267 min

AWS KMS Encryption Architecture (2026): The Per-Tenant CMK Trap, the 10,000 req/s Shared Quota, and When AWS-Owned Keys Win

Most KMS guides stop at "enable encryption." The architecture decision that actually bites is the key boundary: split one CMK into 3,200 per-tenant keys and you pay ~$3,200/mo in key storage alone while still sharing a single 10,000 req/s symmetric quota. The post covers the decision matrix, the throttle math, and the encryption-context pattern that gives per-tenant isolation without per-tenant keys.

AWS Data Residency and Sovereignty in 2026: Regions, Inference Boundaries, and What Actually Stays in Country

Security & Compliance

May 22, 20264 min

AWS Data Residency and Sovereignty in 2026: Regions, Inference Boundaries, and What Actually Stays in Country

The AWS European Sovereign Cloud reached GA in Brandenburg on January 15, 2026, but most EU SaaS workloads still fit standard EU regions plus DPA/SCC. This guide separates data at rest, inference routing (Bedrock geographic vs global profiles), and when sovereign cloud is worth the premium.

AWS CSPM: Native Security Hub Stack vs Third-Party (Wiz, Orca) — 2026 Decision Guide

Security & Compliance

May 21, 20264 min

AWS CSPM: Native Security Hub Stack vs Third-Party (Wiz, Orca) — 2026 Decision Guide

After Security Hub Essentials consolidated Inspector and CSPM into per-resource pricing (example: 500 units ≈ $1,875/mo), most AWS-only estates should run native first. This guide scores when Wiz/Orca-class tools earn a line item, and where paying twice for the same CVE becomes the failure mode.

AWS Security Agent Full Repository Code Review: Trust Boundaries Beyond Pattern-Only SAST

Security & Compliance

May 13, 20265 min

AWS Security Agent Full Repository Code Review: Trust Boundaries Beyond Pattern-Only SAST

July 2026 placement guide for AWS Security Agent full-repository code review (announced May 12, 2026): trust-boundary and data-flow analysis beside Inspector, CI SAST, and a reproducible pilot checklist. Preview terms still apply, so confirm console pricing.

CI/CD Threat Models and Web App Security on AWS: Pipelines, XSS, CSRF, and SQL Injection

Security & Compliance

May 8, 20262 min

CI/CD Threat Models and Web App Security on AWS: Pipelines, XSS, CSRF, and SQL Injection

GitHub Actions OIDC role sessions are short-lived by design, yet teams still paste static access keys into workflow logs until scanners or audits catch the diff. Supply-chain writeups keep repeating the pattern into 2026.

Amazon Bedrock Automated Reasoning Checks: Production Hallucination Prevention with Math-Validated Factuality

Security & Compliance

Apr 28, 20267 min

Amazon Bedrock Automated Reasoning Checks: Production Hallucination Prevention with Math-Validated Factuality

Bedrock Automated Reasoning checks ground LLM outputs against formal logic policies you encode and mathematically validate that the response is consistent with the policy. This guide covers when to use Automated Reasoning vs contextual grounding, how to author the policy in production, the integration with Bedrock Guardrails, and the regulated use cases (HR, insurance, eligibility, regulatory determinations) where the difference matters.

AWS CloudTrail Production Setup: Multi-Region Trails, Log File Validation, and CloudTrail Lake

Security & Compliance

Apr 28, 20268 min

AWS CloudTrail Production Setup: Multi-Region Trails, Log File Validation, and CloudTrail Lake

Production CloudTrail: multi-region org trails, log validation, CMK, Lake + Athena. July 2026 checklist. Event History is not enough.

AWS EBS Encryption and Snapshot Hygiene: Default Encryption, Public Snapshot Prevention, and KMS Key Lifecycle

Security & Compliance

Apr 28, 20268 min

AWS EBS Encryption and Snapshot Hygiene: Default Encryption, Public Snapshot Prevention, and KMS Key Lifecycle

EBS default encryption per Region, CMK lifecycle, block public snapshots. July 2026 baseline checklist. Retrofit is expensive.

AWS IAM Identity Center: Workforce SSO and Identity Propagation in Production

Security & Compliance

Apr 28, 20268 min

AWS IAM Identity Center: Workforce SSO and Identity Propagation in Production

AWS IAM Identity Center is the AWS-native workforce SSO and identity-propagation service. This guide covers federation from Okta / Microsoft Entra ID, permission-set design, attribute-based access control (ABAC), identity propagation to Q Business / Redshift / QuickSight / S3 Access Grants, and the migration off long-lived IAM users.