Uzi Ashkenazi · Cloud Security Architect
Every security decision in the cloud is an identity decision. Most of them are now made by machines.
I write about the layer underneath the checklist: the controls that all turn out to be asking the same question, the vendor stacks that split the same five jobs different ways, and the workloads that now do most of the asking.
The argument, in four posts
- 01 The control point left the network. Zero Trust is sold as a network strategy. That framing buries the lede. Most of the identities we now evaluate are not human. Zero Trust Solved the Human Problem. Machines Are Where the Work Is.
- 02 Four AWS controls, one question underneath all of them. IAM, KMS, CloudTrail, Direct Connect. Open any of them and the same question is sitting inside: which identity, and is it allowed? Securing the Enterprise on AWS: A Practitioner's Foundation
- 03 You have already done federation. It was called AssumeRole. A cross-vendor SAML trust and AssumeRoleWithWebIdentity are one primitive wearing two vendor labels. You've Been Doing Federation Since Day One
- 04 Five Ping products are five familiar jobs with new names. AWS runs the five identity jobs in one engine. Ping splits them across five. The mapping is the useful part. The AWS Security Practitioner's Guide to Ping Identity
Also, on building it
- Building Identity Security Products as a Solo Operator Building a security product while learning the domain and working full time is a coordination problem, not a time problem. Here is the multi-agent pipeline that solves it.
- Claude Code on the Go Claude Code is a long-running interactive process. Mobile networks are not. The fix is a persistent shell on a VPS, tmux, and Blink Shell on iOS.