Blog - Practical insights for IT professionals

AWS Deprecation That Exposed Years of Inherited Infrastructure Debt

08/11/2026 by Serhii Matiushchenko

Reading Time: 4 minutesWhen AWS announced the retirement of the old ec2messages endpoint, it turned out the problem wasn’t just an outdated SSM Agent. This is a story about inherited infrastructure: a 2017 IAM policy that still showed green in the console, and a Terraform module that, if updated the “proper” way, threatened to destroy the storage volumes of a live production cluster. Sometimes the most honest choice is to deliberately leave technical debt in place — rather than force the correct fix and risk breaking everything.

We Thought This Workload Was Using IRSA. It Never Was

08/11/202607/10/2026 by Serhii Matiushchenko

Reading Time: 2 minutesDuring a least-privilege cleanup I discovered that a workload we believed was using IRSA had actually been running on the node IAM role for almost a year. Here’s how it was found and what changed in my verification process.

How Our Nginx Watchdog Missed the Outage It Was Built to Catch

08/11/202606/05/2026 by Serhii Matiushchenko

Reading Time: 6 minutesWe built a watchdog to automatically reload nginx whenever it started timing out against an AWS ALB — the classic “cached a stale IP” problem. It worked… until a different domain on the same box went down for hours while the script sat there happily reporting that everything was fine. This is the story of how a monitoring gap, a partial deploy, and a threshold tuned for the wrong failure shape turned a good idea into false confidence — and what it took to fix the class of problem instead of just the one instance that had already bitten us.

The Firewall Rule That Blocked an IP, and Nothing Else

08/12/202604/08/2026 by Serhii Matiushchenko

Reading Time: 3 minutesBlocking an attacker’s IP address stopped nothing, because the address hitting the edge was never the attacker’s own. The same flood kept coming back seconds later from a brand-new address, one hop further back than the block was looking.

Plan Wanted to Delete the Disks to Fix a Permission

08/12/202604/05/2026 by Serhii Matiushchenko

Reading Time: 3 minutesA one-line module version bump, meant to carry over a small permissions fix, produced a plan that wanted to destroy and rebuild the storage volumes of a live cluster. The resource hadn’t changed at all; the way the tool addressed it internally had.

Three SSH Keys, and Only One of Them Was Telling the Truth

08/12/202603/03/2026 by Serhii Matiushchenko

Reading Time: 3 minutesA routine rolling node replacement turned into a lesson in credential archaeology, with three plausible SSH keys and only one of them actually working, none of the mismatch visible until someone tried to connect under a maintenance-window clock.

Terraform Plan That Wanted to Roll Back Nothing Into Something Worse

08/12/202602/12/2026 by Serhii Matiushchenko

Reading Time: 3 minutesA routine version bump turned into a plan that quietly proposed rolling several production databases backward instead of forward. The infrastructure code hadn’t drifted because someone made a mistake; the databases had simply been patched by the cloud provider without anyone updating the code to match.

The New Server That Was Secretly the Old Server

08/12/202601/05/2026 by Serhii Matiushchenko

Reading Time: 3 minutesA golden image saved us from reinstalling the security agent on every new server, until a handful of freshly launched machines started reporting under the identity of a server that no longer existed. One skipped step during image creation, and the console couldn’t tell the machines apart.

“It’s Already Working in Production” Is Not the Same as “It’s Complete”

08/12/202612/12/2025 by Serhii Matiushchenko

Reading Time: 3 minutesReusing an IAM policy that had been running cleanly in production for months seemed like the safe move, until a newer version of the same controller called an API action the old policy had never heard of, and the failure only showed up after a step Terraform never even touched. Focus keyword: IAM policy version compatibility Title: “It’s Already Working in Production” Is Not the Same as “It’s Complete”.

The Log Group Nobody Configured, and Why the IAM Policy Missed It

08/12/202611/04/2025 by Serhii Matiushchenko

Reading Time: 3 minutesA least-privilege IAM policy was scoped exactly to what the configuration said the log shipper would write to, which turned out to be only half the story: the agent had a hardcoded fallback destination that no config file ever mentioned. Focus keyword: least privilege IAM policy gap Title: The Log Group Nobody Configured, and Why the IAM Policy Missed It