IAM - Practical insights for IT professionals

AWS Deprecation That Exposed Years of Inherited Infrastructure Debt

08/11/2026 by Serhii Matiushchenko

Reading Time: 4 minutesWhen AWS announced the retirement of the old ec2messages endpoint, it turned out the problem wasn’t just an outdated SSM Agent. This is a story about inherited infrastructure: a 2017 IAM policy that still showed green in the console, and a Terraform module that, if updated the “proper” way, threatened to destroy the storage volumes of a live production cluster. Sometimes the most honest choice is to deliberately leave technical debt in place — rather than force the correct fix and risk breaking everything.

We Thought This Workload Was Using IRSA. It Never Was

08/11/202607/10/2026 by Serhii Matiushchenko

Reading Time: 2 minutesDuring a least-privilege cleanup I discovered that a workload we believed was using IRSA had actually been running on the node IAM role for almost a year. Here’s how it was found and what changed in my verification process.

The Log Group Nobody Configured, and Why the IAM Policy Missed It

08/12/202611/04/2025 by Serhii Matiushchenko

Reading Time: 3 minutesA least-privilege IAM policy was scoped exactly to what the configuration said the log shipper would write to, which turned out to be only half the story: the agent had a hardcoded fallback destination that no config file ever mentioned. Focus keyword: least privilege IAM policy gap Title: The Log Group Nobody Configured, and Why the IAM Policy Missed It