Articles about AWS from the ConsultorIA blog: cloud, applied AI and security in production.
Most inventory tools ask for read-only access and trust you got it right. We made Skyline prove it first, because the ReadOnlyAccess policy a team hands you is very often not what they think it is.
Most teams running two or more clouds have never seen them on one page. When they do, the surprises are consistent enough to list: regions nobody chose, resources Terraform does not know about, and a cost distribution that does not match anyone's mental model.
S3 looks like a per-gigabyte price and it is not. Minimum durations, per-object overheads, transition requests and the transfer boundaries around the bucket are where the money actually goes.
Ingestion, storage, custom metrics, dashboards and queries are priced separately. The dimension explosion in custom metrics and debug logging left on in production account for most of the surprise.
Commitments lock in whatever you are running today. Before you sign one, walk the bill layer by layer and remove what should not be there. Here is the order we use.
Most multi-account designs fail because nobody agreed what an account is for. Here is the account map we deploy, what lives in each one, and the three guardrails that make it hold.
Teams argue about which model to use and then ship an assistant that answers confidently from the wrong document. The decisions that actually decide quality are about chunks, permissions, evaluation and cost.
Nobody writes a minimal IAM policy from a blank page. You harvest it from what the role actually did. Here is the loop we run to shrink permissions without breaking production.
A posture review is only as good as its coverage. These are the scanners, IAM analysers and infrastructure-as-code checkers we run on AWS, Google Cloud and Azure, what each one is good at, and where it misleads.
ARM instances are 20 to 40 percent cheaper for the same work, and the migration is mostly a build problem, not a code problem. Here is the order we do it in and the four things that bite.
Kubernetes hides waste better than any other platform, because everything looks busy. Four measurements tell you where the money goes, and three changes usually halve it.
GuardDuty is enabled in most accounts and read in almost none. The fix is not more tuning, it is deciding in advance which five findings wake a human and what they do next.
Public buckets are the headline and the easy part. The leaks we find now come from bucket policies, presigned URLs, replication and logs nobody reads. Here is the full pass.
Knowledge Bases, Guardrails and Agents remove a lot of plumbing. They do not remove the retrieval, permission and evaluation decisions, and that is where projects still fail.
Most Terraform pain is not HCL. It is one enormous state file, applies from laptops and three years of manual console changes nobody imported. Here is how we untangle it.
Aurora is not automatically better or cheaper. It wins on specific axes, loses on others, and the migration has one path that keeps downtime under a minute. Here is the decision and the runbook.
Networking mistakes in AWS are the expensive kind, because fixing them means moving workloads. These six come up in almost every estate we review, and five of them are cheap to get right on day one.
Nmap still finds the things that matter on a cloud perimeter, but only if you scan the right address space with the right flags. How we build the target list, which scan types earn their time, and how to read the output without wasting a week.