Jump to: Pinned repos • All repos ↗ • Contribution graph • Blog ↗
Software engineer focused on cloud infrastructure since 2013. Professional relational database experience since 1996. Professional programming and Unix/Linux experience since 1993. Leadership and business skills from consulting work and an MBA. Training, motivation, team-building, and evaluation skills from past service as a teacher. Past AWS certifications in DevOps and databases. Current AWS certifications in security (3×) and networking. Impeccable writing, technical writing, and presentation skills. 4 human languages: English, French, Spanish, and German.
I've been writing enterprise-quality open-source AWS utility software since 2017. GitHub provides proof of work: revision history plus evidence of real users.
So you can evaluate my technical skills, I've organized short, focused excerpts of my work by topic:
Skills Matrix
Jump to: Terraform • Containers/Docker • IAM
- Secure private network
- Editable configuration, in terms familiar to application developers
- Automatic, no-edit transformations
- Strict, reciprocal security group egress and ingress rules (only known hosts can talk; no private IP address ranges)
- Single, shared definition for all VPC private endpoints of both types (avoids repetition and prevents inconsistencies)
- A container definition that is secure, small, but still simple
- Scalable orchestration with Elastic Container Service (ECS) and load balancing
- Enforce encryption with different KMS keys in different S3 buckets
- Central resource control policy (RCP) covers buckets in many accounts
- Self-service documentation reduces developers' dependence on the infrastructure team
- Templated test buckets support thorough, realistic, automated tests
- Keywords communicate properties of test buckets (avoids duplication and prevents inconsistencies)
- Enforce different storage classes in different S3 buckets
- Central resource control policy (RCP) covers buckets in many accounts
- Architectural decision record: history of S3, IAM, and AWS Organizations feature releases
- Safe permissions delegation trick
(
Detailed semantics, Item 4)
- Make least-privilege practical
- Restrict Lambda function permissions using attribute-based access control, then protect the ABAC tags with a central service control policy (SCP)
- Balance maintainability with security by restricting instead of rewriting an AWS-managed policy
- Avoid infrastructure-as-code duplication with IAM policy variables
- Explanation with examples, in a response to a user
- CloudFormation parameter
- Insertion into IAM policy