Practical insights for IT professionals
Engineering • DevOps • Cloud
Reading Time: 2 minutesDuring a least-privilege cleanup I discovered that a workload we believed was using IRSA had actually been running on the node IAM role for almost a year. Here’s how it was found and what changed in my verification process.
Reading Time: 3 minutesReusing an IAM policy that had been running cleanly in production for months seemed like the safe move, until a newer version of the same controller called an API action the old policy had never heard of, and the failure only showed up after a step Terraform never even touched. Focus keyword: IAM policy version compatibility Title: “It’s Already Working in Production” Is Not the Same as “It’s Complete”.
Reading Time: 3 minutesA least-privilege IAM policy was scoped exactly to what the configuration said the log shipper would write to, which turned out to be only half the story: the agent had a hardcoded fallback destination that no config file ever mentioned. Focus keyword: least privilege IAM policy gap Title: The Log Group Nobody Configured, and Why the IAM Policy Missed It
Reading Time: 3 minutesA correctly configured logging plugin refused to load, across several chart versions, because the chart’s version number had nothing to do with the version of the binary actually running inside it. Focus keyword: Helm chart version vs binary version Title: The Plugin That Should Have Loaded, in a Binary That Never Had It.
Reading Time: 3 minutesA Helm values change deployed cleanly, reported success, and did absolutely nothing, because the chart version in use had never heard of the parameter being set. No error, no warning, just a config that silently went nowhere. Focus keyword: Helm chart silently ignored values Title: The Config Setting That Was Silently Doing Nothing.