https://consultoria.com/blog/ Cloud, applied AI and security, from production. en https://consultoria.com/blog/vector-database-choice https://consultoria.com/blog/vector-database-choice Sun, 13 Sep 2026 00:00:00 +0000 Most teams pick a vector store from a benchmark chart and then discover the thing that hurts is metadata filtering, tenancy or reindexing. If you already run PostgreSQL, pgvector is usually the right answer for longer than people expect. RAG https://consultoria.com/blog/vault-or-cloud-secret-manager https://consultoria.com/blog/vault-or-cloud-secret-manager Sun, 13 Sep 2026 00:00:00 +0000 The choice is not about features. It is about whether you are multi-cloud, whether you need short-lived database credentials, and how much operational load your team can carry. Identity and access https://consultoria.com/blog/us-state-privacy-ccpa-cpra https://consultoria.com/blog/us-state-privacy-ccpa-cpra Sun, 13 Sep 2026 00:00:00 +0000 California set the template and a growing list of states copied it with variations. What differs from GDPR, why the browser opt-out signal is the part teams miss, and how to build once for a list that keeps growing. Compliance https://consultoria.com/blog/unit-economics-cost-per-customer https://consultoria.com/blog/unit-economics-cost-per-customer Sun, 13 Sep 2026 00:00:00 +0000 A cloud bill growing with revenue is fine. One growing faster is a business problem hiding inside an infrastructure report. Pick the unit, attribute the shared cost, and the conversation with the board changes. FinOps https://consultoria.com/blog/testing-infrastructure-code https://consultoria.com/blog/testing-infrastructure-code Sun, 13 Sep 2026 00:00:00 +0000 Formatting and validation are free, static analysis is nearly free, policy on the plan is cheap, and real apply-and-destroy tests are expensive and slow. Spend accordingly, and know what each layer cannot catch. TerraformCI/CD and DevOps https://consultoria.com/blog/terraform-module-design https://consultoria.com/blog/terraform-module-design Sun, 13 Sep 2026 00:00:00 +0000 The two failures are a module that wraps one resource and adds nothing, and a module that does everything and nobody dares change. A minimal interface, safe defaults and honest versioning are what separate them. Terraform https://consultoria.com/blog/stateful-workloads-kubernetes https://consultoria.com/blog/stateful-workloads-kubernetes Sun, 13 Sep 2026 00:00:00 +0000 A StatefulSet guarantees less than people assume, a volume pins a pod to a zone, and the honest question is whether that database belongs in the cluster at all. KubernetesData platform https://consultoria.com/blog/slos-and-error-budgets https://consultoria.com/blog/slos-and-error-budgets Sun, 13 Sep 2026 00:00:00 +0000 Most service level objectives are picked from the metric the team already had, and never change anyone's behaviour. Here is how to choose the indicator from the user's experience and wire an error budget to a real decision. Observability https://consultoria.com/blog/skyline-terraform-before-apply https://consultoria.com/blog/skyline-terraform-before-apply Sun, 13 Sep 2026 00:00:00 +0000 A plan is a thousand lines of diff in a terminal. The questions you actually want answered — what does this cost, what does it expose, what breaks if it fails — are not in that format. Here is how we made Skyline answer them from the code alone. TerraformFinOps https://consultoria.com/blog/skyline-read-only-scan-guarantee https://consultoria.com/blog/skyline-read-only-scan-guarantee Sun, 13 Sep 2026 00:00:00 +0000 Most inventory tools ask for read-only access and trust you got it right. We made Skyline prove it first, because the ReadOnlyAccess policy a team hands you is very often not what they think it is. Identity and accessAWS https://consultoria.com/blog/skyline-one-map-four-clouds https://consultoria.com/blog/skyline-one-map-four-clouds Sun, 13 Sep 2026 00:00:00 +0000 Most teams running two or more clouds have never seen them on one page. When they do, the surprises are consistent enough to list: regions nobody chose, resources Terraform does not know about, and a cost distribution that does not match anyone's mental model. AWSFinOps https://consultoria.com/blog/service-mesh-when-worth-it https://consultoria.com/blog/service-mesh-when-worth-it Sun, 13 Sep 2026 00:00:00 +0000 Mutual TLS, fine-grained traffic control and uniform telemetry without touching application code. What each one actually costs in latency, memory and operational load, and the cheaper things that cover two out of three. Kubernetes https://consultoria.com/blog/serverless-vs-containers https://consultoria.com/blog/serverless-vs-containers Sun, 13 Sep 2026 00:00:00 +0000 The choice is not about elegance. It is traffic shape, cold start tolerance, execution duration, environment control and what your team can actually operate at three in the morning. Serverless and events https://consultoria.com/blog/self-hosting-open-models-gpu-cost https://consultoria.com/blog/self-hosting-open-models-gpu-cost Sun, 13 Sep 2026 00:00:00 +0000 The cost per token looks obviously cheaper until you account for utilisation. GPUs bill by the hour whether or not anyone is asking questions, and that single fact decides most of these decisions. LLMs and agentsFinOps https://consultoria.com/blog/secret-rotation-that-works https://consultoria.com/blog/secret-rotation-that-works Sun, 13 Sep 2026 00:00:00 +0000 Rotation fails when the application reads the secret once at startup. Two valid credentials during the change window, an inventory that is real, and deletion instead of rotation for the credentials that should not exist at all. Identity and access https://consultoria.com/blog/rto-rpo-and-the-restore-test https://consultoria.com/blog/rto-rpo-and-the-restore-test Sun, 13 Sep 2026 00:00:00 +0000 Most teams have backups and no idea how long a restore takes. Set recovery targets per service, prove them with a quarterly restore test, and write the plan so it fits on one page. Resilience and continuity https://consultoria.com/blog/queues-and-event-streams https://consultoria.com/blog/queues-and-event-streams Sun, 13 Sep 2026 00:00:00 +0000 One distributes work and forgets it. The other is an ordered log several consumers can replay. Choosing the wrong one produces an architecture that fights you for years. Serverless and eventsData platform https://consultoria.com/blog/pulumi-vs-terraform https://consultoria.com/blog/pulumi-vs-terraform Sun, 13 Sep 2026 00:00:00 +0000 Loops, types and tests come free with a general-purpose language. What you give up is a plan a non-programmer can review, and a low floor for the people who have to maintain it at three in the morning. Terraform https://consultoria.com/blog/prompt-injection-defences https://consultoria.com/blog/prompt-injection-defences Sun, 13 Sep 2026 00:00:00 +0000 Any agent that reads untrusted content and can act will eventually take instructions from that content. The defences that work are architectural, not textual. LLMs and agentsCompliance https://consultoria.com/blog/prometheus-at-scale https://consultoria.com/blog/prometheus-at-scale Sun, 13 Sep 2026 00:00:00 +0000 Cardinality is behind almost every Prometheus problem you will have, and it is usually one label added by one well-meaning engineer. How to find it, how to survive retention and HA, and when Thanos or Mimir is actually justified. ObservabilityKubernetes https://consultoria.com/blog/postgres-tuning-managed-cloud https://consultoria.com/blog/postgres-tuning-managed-cloud Sun, 13 Sep 2026 00:00:00 +0000 Nearly every performance incident we investigate is a missing index, a connection pool that is not there, or autovacuum sized for a database a tenth the size. Resizing the instance is the fix people try first and it is almost never the answer. Data platform https://consultoria.com/blog/osquery-fleet-visibility https://consultoria.com/blog/osquery-fleet-visibility Sun, 13 Sep 2026 00:00:00 +0000 Most questions during an incident or an audit are inventory questions, and most organisations answer them with a spreadsheet. A SQL interface over live endpoint state answers them in seconds, and the scheduling is where it goes wrong. Pentesting tools https://consultoria.com/blog/opentofu-or-terraform https://consultoria.com/blog/opentofu-or-terraform Sun, 13 Sep 2026 00:00:00 +0000 The licence change matters differently to an end user, a software vendor and a consultancy. Compatibility is high and diverging, migration is cheap and returning is not. Here is the decision framework without the partisanship. Terraform https://consultoria.com/blog/opentelemetry-adoption https://consultoria.com/blog/opentelemetry-adoption Sun, 13 Sep 2026 00:00:00 +0000 OpenTelemetry is not equally mature across traces, metrics and logs, and the adoption plans that fail treat it as one migration. Here is the order that works and where the double-billing months come from. Observability https://consultoria.com/blog/opencost-kubecost-showback https://consultoria.com/blog/opencost-kubecost-showback Sun, 13 Sep 2026 00:00:00 +0000 Allocation by requests or by usage creates opposite incentives, shared costs start the argument, and showback before chargeback is what stops the whole exercise being rejected. FinOpsKubernetes https://consultoria.com/blog/oci-cost-controls-and-commitments https://consultoria.com/blog/oci-cost-controls-and-commitments Sun, 13 Sep 2026 00:00:00 +0000 Compartments and defined tags are the allocation model, flexible shapes make rightsizing continuous rather than stepwise, and the universal credit commitment behaves differently from a reservation. Oracle CloudFinOps https://consultoria.com/blog/multi-region-failover-cost https://consultoria.com/blog/multi-region-failover-cost Sun, 13 Sep 2026 00:00:00 +0000 Cold, warm and hot standby differ by an order of magnitude in price and by minutes or hours in recovery. Pick the tier from what an outage actually costs you, and be honest that most estates should buy multi-zone instead. Resilience and continuityFinOps https://consultoria.com/blog/metasploit-controlled-exploitation https://consultoria.com/blog/metasploit-controlled-exploitation Sun, 13 Sep 2026 00:00:00 +0000 A scanner says a host is probably vulnerable. Controlled exploitation in an authorised engagement turns "probably" into "here is what an attacker gets", which is the difference between a finding people fix and one they file. Pentesting tools https://consultoria.com/blog/logging-cost-and-structure https://consultoria.com/blog/logging-cost-and-structure Sun, 13 Sep 2026 00:00:00 +0000 Log volume rises with traffic, with every new service and with every debugging session somebody forgot to turn off. Structure decides whether they are useful, and six rules decide whether they are affordable. ObservabilityFinOps https://consultoria.com/blog/llm-guardrails-in-production https://consultoria.com/blog/llm-guardrails-in-production Sun, 13 Sep 2026 00:00:00 +0000 A classifier on every request costs time and money on every request. What to check on input, what to check on output, and how to decide whether the guardrail is worth what it takes. LLMs and agents https://consultoria.com/blog/llm-evaluation-beyond-vibes https://consultoria.com/blog/llm-evaluation-beyond-vibes Sun, 13 Sep 2026 00:00:00 +0000 A hundred real cases, per-task metrics instead of one score, and a judge calibrated against human labels. That is enough to catch regressions and to decide whether a model change is safe. LLMs and agents https://consultoria.com/blog/lakehouse-snowflake-databricks https://consultoria.com/blog/lakehouse-snowflake-databricks Sun, 13 Sep 2026 00:00:00 +0000 Open table formats changed the negotiation by separating storage from compute. What is left to decide is your workload mix, your governance boundary, and which cost model you can actually control. Data platform https://consultoria.com/blog/kyverno-vs-gatekeeper https://consultoria.com/blog/kyverno-vs-gatekeeper Sun, 13 Sep 2026 00:00:00 +0000 Kyverno or Gatekeeper is a smaller decision than how you roll policy out. Audit, then warn, then enforce, with system namespaces excluded and a failure policy you have thought about. KubernetesCompliance https://consultoria.com/blog/kubescape-cluster-posture https://consultoria.com/blog/kubescape-cluster-posture Sun, 13 Sep 2026 00:00:00 +0000 Every Kubernetes benchmark scan produces hundreds of findings and the same handful matter. Here is which ones, why the control plane checks mostly do not apply on managed clusters, and how to stop the report being ignored. Pentesting toolsKubernetes https://consultoria.com/blog/kubernetes-multi-tenancy https://consultoria.com/blog/kubernetes-multi-tenancy Sun, 13 Sep 2026 00:00:00 +0000 A namespace is a naming boundary, not a security boundary. Quotas, default-deny network policy, workload identity and a clear answer on node isolation are what make a shared cluster work. KubernetesIdentity and access https://consultoria.com/blog/kubernetes-cluster-upgrades https://consultoria.com/blog/kubernetes-cluster-upgrades Sun, 13 Sep 2026 00:00:00 +0000 The support calendar decides your schedule whether you plan or not. Deprecated APIs, blocked drains and add-ons that lag the control plane are the three things that turn an upgrade into an incident. Kubernetes https://consultoria.com/blog/jenkins-in-2026-keep-or-migrate https://consultoria.com/blog/jenkins-in-2026-keep-or-migrate Sun, 13 Sep 2026 00:00:00 +0000 Most companies running Jenkins are not running it badly, they are running it unattended. How to tell a Jenkins worth keeping from one that is quietly costing you a day a week, and what migration actually costs. CI/CD and DevOpsAutomation https://consultoria.com/blog/iso-42001-ai-management https://consultoria.com/blog/iso-42001-ai-management Sun, 13 Sep 2026 00:00:00 +0000 It is not a certification of your model. It is the scaffolding that makes AI governance repeatable, and if you already run ISO 27001, most of the machinery is built. ComplianceLLMs and agents https://consultoria.com/blog/infracost-in-pull-requests https://consultoria.com/blog/infracost-in-pull-requests Sun, 13 Sep 2026 00:00:00 +0000 Infracost turns a Terraform plan into a monthly delta on the pull request. What it estimates well, what it cannot estimate at all, and how to keep the comment from becoming wallpaper. FinOpsCI/CD and DevOps https://consultoria.com/blog/incident-response-runbooks https://consultoria.com/blog/incident-response-runbooks Sun, 13 Sep 2026 00:00:00 +0000 Severity defined by criteria instead of instinct, three roles, one timeline and a named person who decides whether to notify. Everything else in an incident process is optional. Resilience and continuityCompliance https://consultoria.com/blog/human-in-the-loop-approvals https://consultoria.com/blog/human-in-the-loop-approvals Sun, 13 Sep 2026 00:00:00 +0000 An approval step is the cheapest safety control and the easiest one to place badly. Put it too early and you have automated nothing; too late and you are rubber-stamping. Four placements and when each is right. AutomationLLMs and agents https://consultoria.com/blog/hipaa-cloud-workloads https://consultoria.com/blog/hipaa-cloud-workloads Sun, 13 Sep 2026 00:00:00 +0000 The business associate agreement is the easy part. Which services you may use, which data you can avoid holding, and the six technical safeguards that turn into actual configuration. Compliance https://consultoria.com/blog/gdpr-engineering-controls https://consultoria.com/blog/gdpr-engineering-controls Sun, 13 Sep 2026 00:00:00 +0000 The auditor does not read your privacy policy. They ask which system holds personal data, how long it keeps it, who can read it and what happens when someone asks for a copy. Those are engineering questions. Compliance https://consultoria.com/blog/gcp-logging-and-storage-costs https://consultoria.com/blog/gcp-logging-and-storage-costs Sun, 13 Sep 2026 00:00:00 +0000 An exclusion filter at the sink is the highest-return control in the whole platform, and the storage class minimums punish a lifecycle rule written without reading them. Google CloudFinOps https://consultoria.com/blog/gcp-gke-cost-and-autoscaling https://consultoria.com/blog/gcp-gke-cost-and-autoscaling Sun, 13 Sep 2026 00:00:00 +0000 Standard bills for nodes you provision, Autopilot bills for pod resources you request. Both are dominated by the same number, and it is the gap between what pods ask for and what they use. Google CloudKubernetesFinOps https://consultoria.com/blog/gateway-api-vs-ingress https://consultoria.com/blog/gateway-api-vs-ingress Sun, 13 Sep 2026 00:00:00 +0000 Gateway API is usually sold on features. The real reason to move is that Ingress has no separation between the team that owns the load balancer and the team that owns the route. Here is the migration that does not need a maintenance window. Kubernetes https://consultoria.com/blog/focus-billing-standard https://consultoria.com/blog/focus-billing-standard Sun, 13 Sep 2026 00:00:00 +0000 Every provider names, groups and dates its billing data differently, so multi-cloud cost reporting turns into a translation project. An open specification fixes the schema, and what it cannot fix is worth knowing before you build. FinOps https://consultoria.com/blog/fine-tuning-vs-prompting https://consultoria.com/blog/fine-tuning-vs-prompting Sun, 13 Sep 2026 00:00:00 +0000 Fine-tuning teaches behaviour and format. Retrieval supplies knowledge. Prompting shapes the immediate task. Most teams reach for the expensive one to fix a problem it cannot fix. LLMs and agents https://consultoria.com/blog/fedramp-vs-soc2 https://consultoria.com/blog/fedramp-vs-soc2 Sun, 13 Sep 2026 00:00:00 +0000 They look like neighbours and they are not. One is an attestation you commission, the other is an authorisation you earn against a prescribed control baseline, and the cost difference is an order of magnitude. Compliance https://consultoria.com/blog/falco-runtime-detection https://consultoria.com/blog/falco-runtime-detection Sun, 13 Sep 2026 00:00:00 +0000 Image scanning finds known vulnerabilities before deployment. Runtime detection catches the shell that spawned inside a running pod at three in the morning. The default rules are noisy and tuning them is the entire project. Pentesting toolsKubernetes https://consultoria.com/blog/external-secrets-operator https://consultoria.com/blog/external-secrets-operator Sun, 13 Sep 2026 00:00:00 +0000 Getting secrets out of manifests means an operator that syncs from your cloud's vault, a driver that mounts them, or both. The part that decides which is what your application does when the value changes. KubernetesIdentity and access https://consultoria.com/blog/eu-us-data-transfers https://consultoria.com/blog/eu-us-data-transfers Sun, 13 Sep 2026 00:00:00 +0000 Transfer mechanisms, region choice and support access are three different questions that get merged into one. How to answer a European buyer's questionnaire with facts rather than assurances. Compliance https://consultoria.com/blog/eu-cyber-resilience-act https://consultoria.com/blog/eu-cyber-resilience-act Sun, 13 Sep 2026 00:00:00 +0000 If you sell software or connected hardware into the EU, security stops being a quality attribute and becomes a market access requirement, with a vulnerability reporting clock and a support period you must declare. Compliance https://consultoria.com/blog/eu-ai-act-obligations https://consultoria.com/blog/eu-ai-act-obligations Sun, 13 Sep 2026 00:00:00 +0000 Most teams either assume the AI Act does not touch them or assume it bans what they are building. How to establish your role and risk tier, and what the obligations cost an engineering team. ComplianceLLMs and agents https://consultoria.com/blog/distributed-tracing-debugging https://consultoria.com/blog/distributed-tracing-debugging Sun, 13 Sep 2026 00:00:00 +0000 Most tracing deployments produce disconnected single spans and a bill. Context propagation, tail sampling and a handful of useful attributes are what turn a trace store into the tool you open during an incident. Observability https://consultoria.com/blog/detection-as-code-sigma https://consultoria.com/blog/detection-as-code-sigma Sun, 13 Sep 2026 00:00:00 +0000 Sigma is a vendor-neutral format for detection logic that compiles to your platform's query language. The format is the easy part. Version control, testing and a lifecycle for rules are what make detection work. Pentesting toolsCompliance https://consultoria.com/blog/crossplane-control-plane https://consultoria.com/blog/crossplane-control-plane Sun, 13 Sep 2026 00:00:00 +0000 A pipeline runs when someone triggers it. A controller reconciles continuously, which fixes drift by construction. What you pay is another control plane to operate and a harder debugging story. TerraformKubernetes https://consultoria.com/blog/cost-anomaly-detection https://consultoria.com/blog/cost-anomaly-detection Sun, 13 Sep 2026 00:00:00 +0000 A budget does not stop spending and a forecast alert arrives late. What actually catches a cost spike is a short detection window, a small set of known failure shapes and a named owner. FinOps https://consultoria.com/blog/chunking-and-embeddings https://consultoria.com/blog/chunking-and-embeddings Sun, 13 Sep 2026 00:00:00 +0000 Teams upgrade the generation model to fix a retrieval problem. The chunk boundaries, what context travels with each chunk, the embedding model and a reranker account for most of the quality gap. RAG https://consultoria.com/blog/chaos-engineering-first-experiments https://consultoria.com/blog/chaos-engineering-first-experiments Sun, 13 Sep 2026 00:00:00 +0000 Chaos engineering fails when it starts with a tool and a production cluster. Start with a hypothesis, a small blast radius and a stop condition, and the first five experiments will find something every time. Resilience and continuity https://consultoria.com/blog/caching-redis-valkey https://consultoria.com/blog/caching-redis-valkey Sun, 13 Sep 2026 00:00:00 +0000 Invalidation, stampede and the day the cache fills are the three. A time to live is the boring correct answer to the first, and most caching problems turn out to be a missing index. Data platform https://consultoria.com/blog/backup-strategy-and-ransomware https://consultoria.com/blog/backup-strategy-and-ransomware Sun, 13 Sep 2026 00:00:00 +0000 Ransomware crews go for the backups first, and cloud backups are easier to delete than tape ever was. Immutability, credential separation and a copy outside the blast radius are what turn a backup into a recovery. Resilience and continuityCompliance https://consultoria.com/blog/backstage-developer-portal https://consultoria.com/blog/backstage-developer-portal Sun, 13 Sep 2026 00:00:00 +0000 Backstage solves three real problems: finding who owns a service, creating one with the right scaffolding, and keeping docs near the code. It fails when the catalogue is maintained by hand. CI/CD and DevOps https://consultoria.com/blog/azure-storage-and-egress-costs https://consultoria.com/blog/azure-storage-and-egress-costs Sun, 13 Sep 2026 00:00:00 +0000 Storage looks cheap per gigabyte, so nobody audits it. Then redundancy, transactions, early-deletion penalties and cross-region transfer turn a small line into a large one. AzureFinOps https://consultoria.com/blog/azure-monitor-log-analytics-cost https://consultoria.com/blog/azure-monitor-log-analytics-cost Sun, 13 Sep 2026 00:00:00 +0000 Log Analytics ingestion is the line that grows without anyone deciding it should. Six controls bring it down, and none of them mean losing the telemetry you actually use. AzureFinOps https://consultoria.com/blog/azure-aks-cost-and-autoscaling https://consultoria.com/blog/azure-aks-cost-and-autoscaling Sun, 13 Sep 2026 00:00:00 +0000 The AKS control plane is nearly free, so everything you pay comes from node pools, and the defaults are expensive. Here is what we change, in the order that finds money fastest. AzureKubernetesFinOps https://consultoria.com/blog/aws-s3-and-data-transfer-costs https://consultoria.com/blog/aws-s3-and-data-transfer-costs Sun, 13 Sep 2026 00:00:00 +0000 S3 looks like a per-gigabyte price and it is not. Minimum durations, per-object overheads, transition requests and the transfer boundaries around the bucket are where the money actually goes. AWSFinOps https://consultoria.com/blog/aws-cloudwatch-cost-control https://consultoria.com/blog/aws-cloudwatch-cost-control Sun, 13 Sep 2026 00:00:00 +0000 Ingestion, storage, custom metrics, dashboards and queries are priced separately. The dimension explosion in custom metrics and debug logging left on in production account for most of the surprise. AWSFinOps https://consultoria.com/blog/aws-bill-five-layers https://consultoria.com/blog/aws-bill-five-layers Sun, 13 Sep 2026 00:00:00 +0000 Commitments lock in whatever you are running today. Before you sign one, walk the bill layer by layer and remove what should not be there. Here is the order we use. AWSFinOps https://consultoria.com/blog/atomic-red-team-purple-teaming https://consultoria.com/blog/atomic-red-team-purple-teaming Sun, 13 Sep 2026 00:00:00 +0000 A rule that has never fired is either excellent or broken, and you cannot tell from the outside. Adversary emulation runs the technique deliberately, in a controlled way, so that the answer stops being a guess. Pentesting tools https://consultoria.com/blog/alerting-people-answer https://consultoria.com/blog/alerting-people-answer Sun, 13 Sep 2026 00:00:00 +0000 An on-call rota that gets 40 pages a week is not monitoring, it is a filter that trains humans to dismiss things. Alert on symptoms, alert on burn rate, and delete everything nobody has ever acted on. Observability https://consultoria.com/blog/airflow-dbt-pipelines https://consultoria.com/blog/airflow-dbt-pipelines Sun, 13 Sep 2026 00:00:00 +0000 Airflow should schedule and coordinate, never process. dbt should transform inside the warehouse with tests attached. The failure that costs most is data quality nobody checked until a dashboard was wrong for a quarter. Data platform https://consultoria.com/blog/jenkins-pipelines-that-scale https://consultoria.com/blog/jenkins-pipelines-that-scale Sat, 12 Sep 2026 00:00:00 +0000 The three changes that turn a hand-configured Jenkins into one you can rebuild from an empty machine in twenty minutes, and what each one costs to adopt. CI/CD and DevOpsKubernetes https://consultoria.com/blog/aws-landing-zone-multi-account https://consultoria.com/blog/aws-landing-zone-multi-account Sat, 12 Sep 2026 00:00:00 +0000 Most multi-account designs fail because nobody agreed what an account is for. Here is the account map we deploy, what lives in each one, and the three guardrails that make it hold. AWSTerraform https://consultoria.com/blog/ai-automation-observability https://consultoria.com/blog/ai-automation-observability Sat, 12 Sep 2026 00:00:00 +0000 Traditional monitoring tells you the workflow succeeded. With a model in the middle, succeeding and being right are different things. What to capture, and the three dashboards worth building. AutomationLLMs and agents https://consultoria.com/blog/mcp-servers-internal-tools https://consultoria.com/blog/mcp-servers-internal-tools Fri, 11 Sep 2026 00:00:00 +0000 The Model Context Protocol turns an internal API into something an agent can call. The protocol is the easy part; the design decisions are which operations to expose, at what granularity, and under whose identity. AutomationLLMs and agents https://consultoria.com/blog/gitlab-ci-vs-github-actions https://consultoria.com/blog/gitlab-ci-vs-github-actions Fri, 11 Sep 2026 00:00:00 +0000 Both will build your containers. The differences that actually decide it are runner economics, how each handles multi-repo pipelines, and what happens to your secrets. CI/CD and DevOpsAutomation https://consultoria.com/blog/rag-four-decisions https://consultoria.com/blog/rag-four-decisions Thu, 10 Sep 2026 00:00:00 +0000 Teams argue about which model to use and then ship an assistant that answers confidently from the wrong document. The decisions that actually decide quality are about chunks, permissions, evaluation and cost. RAGLLMs and agentsAWS https://consultoria.com/blog/github-actions-self-hosted-runners https://consultoria.com/blog/github-actions-self-hosted-runners Thu, 10 Sep 2026 00:00:00 +0000 Hosted minutes stop being cheap somewhere around 100,000 a month. Running your own runners on Kubernetes is straightforward; running them safely takes three specific decisions. CI/CD and DevOpsKubernetes https://consultoria.com/blog/pipeline-speed-and-build-cache https://consultoria.com/blog/pipeline-speed-and-build-cache Wed, 09 Sep 2026 00:00:00 +0000 Pipeline duration is the cheapest developer productivity lever most teams never pull. Where the time really goes, and how to get a 40-minute build under 10 without changing CI vendor. CI/CD and DevOpsAutomation https://consultoria.com/blog/agents-md-and-context-files https://consultoria.com/blog/agents-md-and-context-files Wed, 09 Sep 2026 00:00:00 +0000 Most of the friction people blame on the model is a missing paragraph in the repository. What belongs in a context file, what does not, and why the ones that grow past a page stop working. Coding agentsLLMs and agents https://consultoria.com/blog/aws-iam-least-privilege-access-analyzer https://consultoria.com/blog/aws-iam-least-privilege-access-analyzer Tue, 08 Sep 2026 00:00:00 +0000 Nobody writes a minimal IAM policy from a blank page. You harvest it from what the role actually did. Here is the loop we run to shrink permissions without breaking production. AWSIdentity and access https://consultoria.com/blog/argocd-gitops-production https://consultoria.com/blog/argocd-gitops-production Tue, 08 Sep 2026 00:00:00 +0000 Argo CD is easy to install and easy to misuse. The repository layout, the sync policy and the secrets decision that separate a working GitOps setup from a dashboard full of red. CI/CD and DevOpsKubernetes https://consultoria.com/blog/ci-secrets-oidc-federation https://consultoria.com/blog/ci-secrets-oidc-federation Mon, 07 Sep 2026 00:00:00 +0000 The static access key in your pipeline is the credential most likely to end up in a breach report. OIDC federation removes it in an afternoon, and the trust policy is where people get it wrong. CI/CD and DevOpsIdentity and access https://consultoria.com/blog/ai-coding-agent-review-gates https://consultoria.com/blog/ai-coding-agent-review-gates Mon, 07 Sep 2026 00:00:00 +0000 The bottleneck moved from writing to reviewing, and the old review habits do not scale to it. Four gates that keep quality without turning one senior engineer into a queue. Coding agentsLLMs and agents https://consultoria.com/blog/progressive-delivery-argo-rollouts-flagger https://consultoria.com/blog/progressive-delivery-argo-rollouts-flagger Sun, 06 Sep 2026 00:00:00 +0000 Shifting 10 percent of traffic to a new version is not a canary if nothing is watching. The metrics, the analysis window and the abort rule that make progressive delivery worth the complexity. CI/CD and DevOpsKubernetes https://consultoria.com/blog/cloud-posture-open-source-tools https://consultoria.com/blog/cloud-posture-open-source-tools Sun, 06 Sep 2026 00:00:00 +0000 A posture review is only as good as its coverage. These are the scanners, IAM analysers and infrastructure-as-code checkers we run on AWS, Google Cloud and Azure, what each one is good at, and where it misleads. Pentesting toolsAWSIdentity and access https://consultoria.com/blog/cursor-vs-claude-code https://consultoria.com/blog/cursor-vs-claude-code Sat, 05 Sep 2026 00:00:00 +0000 One keeps you in the loop at every keystroke, the other takes a task away and brings back a diff. Most teams that argue about which to standardise on end up using both, for reasons that are easy to state. Coding agentsLLMs and agents https://consultoria.com/blog/ansible-and-terraform-together https://consultoria.com/blog/ansible-and-terraform-together Sat, 05 Sep 2026 00:00:00 +0000 Terraform creates the machine, Ansible decides what is on it. Where the boundary belongs, why provisioners are a trap, and what changes when your estate is mostly containers. CI/CD and DevOpsTerraform https://consultoria.com/blog/ci-cd-on-kubernetes-tekton-argo-workflows https://consultoria.com/blog/ci-cd-on-kubernetes-tekton-argo-workflows Fri, 04 Sep 2026 00:00:00 +0000 Kubernetes-native CI gives you pipelines as custom resources and scaling for free. It also gives you a pipeline engine you now operate. When that trade is worth making. CI/CD and DevOpsKubernetes https://consultoria.com/blog/aws-graviton-migration https://consultoria.com/blog/aws-graviton-migration Fri, 04 Sep 2026 00:00:00 +0000 ARM instances are 20 to 40 percent cheaper for the same work, and the migration is mostly a build problem, not a code problem. Here is the order we do it in and the four things that bite. AWSFinOps https://consultoria.com/blog/claude-code-in-a-team https://consultoria.com/blog/claude-code-in-a-team Thu, 03 Sep 2026 00:00:00 +0000 A coding agent with shell access and repo context is a different tool from an autocomplete. The gains are real and they land unevenly; the cost is that review becomes the bottleneck. What we changed after six months. Coding agentsLLMs and agents https://consultoria.com/blog/agent-tool-permissions-blast-radius https://consultoria.com/blog/agent-tool-permissions-blast-radius Tue, 01 Sep 2026 00:00:00 +0000 An agent is an identity that takes instructions from text it did not write. Scope it like a service account you assume is partly compromised, because in the injection case it is. AutomationIdentity and access https://consultoria.com/blog/aws-eks-cost-and-autoscaling https://consultoria.com/blog/aws-eks-cost-and-autoscaling Mon, 31 Aug 2026 00:00:00 +0000 Kubernetes hides waste better than any other platform, because everything looks busy. Four measurements tell you where the money goes, and three changes usually halve it. AWSKubernetes https://consultoria.com/blog/openclaw-self-hosted-assistant https://consultoria.com/blog/openclaw-self-hosted-assistant Sun, 30 Aug 2026 00:00:00 +0000 An open-source assistant that lives on your own server, talks to you through the messaging app you already use and runs tools on your behalf. Genuinely useful, and the most over-permissioned thing most people will ever install. AutomationLLMs and agents https://consultoria.com/blog/automation-cost-per-run https://consultoria.com/blog/automation-cost-per-run Fri, 28 Aug 2026 00:00:00 +0000 The model is rarely the expensive part. Platform operations, the APIs you call, the retries and the human who checks the output usually add up to more. A worked breakdown of one real invoice-processing flow. AutomationFinOps https://consultoria.com/blog/aws-guardduty-noise-to-signal https://consultoria.com/blog/aws-guardduty-noise-to-signal Thu, 27 Aug 2026 00:00:00 +0000 GuardDuty is enabled in most accounts and read in almost none. The fix is not more tuning, it is deciding in advance which five findings wake a human and what they do next. AWSCompliance https://consultoria.com/blog/automation-idempotency-retries https://consultoria.com/blog/automation-idempotency-retries Wed, 26 Aug 2026 00:00:00 +0000 Automations fail on a Tuesday at 3am and nobody notices until the customer calls. Four mechanisms — idempotency keys, bounded retries, a dead letter queue and an alert that names the business event — fix most of it. Automation https://consultoria.com/blog/n8n-ai-agent-nodes https://consultoria.com/blog/n8n-ai-agent-nodes Mon, 24 Aug 2026 00:00:00 +0000 An AI node in a workflow is a non-deterministic step in a deterministic pipeline. That is fine for classification and drafting, and dangerous for routing and writes. Here is where we draw the line. AutomationLLMs and agents https://consultoria.com/blog/aws-s3-security-checklist https://consultoria.com/blog/aws-s3-security-checklist Sun, 23 Aug 2026 00:00:00 +0000 Public buckets are the headline and the easy part. The leaks we find now come from bucket policies, presigned URLs, replication and logs nobody reads. Here is the full pass. AWSCompliance https://consultoria.com/blog/make-scenarios-at-scale https://consultoria.com/blog/make-scenarios-at-scale Sat, 22 Aug 2026 00:00:00 +0000 In Make, every module run is money, so the cheapest scenario and the fastest scenario are usually the same one. Five patterns that cut consumption by half without changing what the automation does. AutomationFinOps https://consultoria.com/blog/compliance-as-code-control-mapping https://consultoria.com/blog/compliance-as-code-control-mapping Fri, 21 Aug 2026 00:00:00 +0000 ISO 27001, SOC 2, ENS and NIS2 overlap heavily. Running them as four separate projects triples the cost. How to build a single control set with a single evidence pipeline, and where the mapping genuinely breaks down. Compliance https://consultoria.com/blog/n8n-vs-make-vs-zapier https://consultoria.com/blog/n8n-vs-make-vs-zapier Thu, 20 Aug 2026 00:00:00 +0000 The three tools do the same demo. They diverge on pricing shape, where your data sits, and what happens when a workflow needs real code. Pick on those, not on the connector count. AutomationFinOps https://consultoria.com/blog/aws-bedrock-rag-production https://consultoria.com/blog/aws-bedrock-rag-production Wed, 19 Aug 2026 00:00:00 +0000 Knowledge Bases, Guardrails and Agents remove a lot of plumbing. They do not remove the retrieval, permission and evaluation decisions, and that is where projects still fail. AWSRAG https://consultoria.com/blog/n8n-self-hosted-production https://consultoria.com/blog/n8n-self-hosted-production Tue, 18 Aug 2026 00:00:00 +0000 n8n on a single container is a demo. Running it for a company means queue mode, a real database, a plan for credentials and a restore you have tested. Here is the shape that survives. AutomationKubernetes https://consultoria.com/blog/dora-financial-resilience https://consultoria.com/blog/dora-financial-resilience Mon, 17 Aug 2026 00:00:00 +0000 DORA applies to banks and insurers, but its contractual and oversight provisions reach their ICT providers directly. What changes in your contracts, your exit plans and your incident reporting if your customers are regulated. Compliance https://consultoria.com/blog/automating-cloud-ops-with-agents https://consultoria.com/blog/automating-cloud-ops-with-agents Sun, 16 Aug 2026 00:00:00 +0000 An agent with cloud credentials is the most useful and most dangerous automation you can build. The pattern that works is investigation with a read-only role and change as a reviewed plan. AutomationTerraform https://consultoria.com/blog/aws-terraform-state-and-pipelines https://consultoria.com/blog/aws-terraform-state-and-pipelines Sat, 15 Aug 2026 00:00:00 +0000 Most Terraform pain is not HCL. It is one enormous state file, applies from laptops and three years of manual console changes nobody imported. Here is how we untangle it. AWSTerraform https://consultoria.com/blog/webhook-queue-architecture https://consultoria.com/blog/webhook-queue-architecture Fri, 14 Aug 2026 00:00:00 +0000 Whatever platform draws the boxes, the automations that stay up have the same three pieces underneath. Here is the shape, and the five decisions that make it hold under load. Automation https://consultoria.com/blog/pci-dss-4-cloud-scope https://consultoria.com/blog/pci-dss-4-cloud-scope Thu, 13 Aug 2026 00:00:00 +0000 Every control in PCI DSS applies to everything in scope, so the cheapest compliance project is the one that removes systems from scope. How tokenisation, segmentation and a hosted payment page change the size of the problem. Compliance https://consultoria.com/blog/prompt-versioning-and-evals https://consultoria.com/blog/prompt-versioning-and-evals Wed, 12 Aug 2026 00:00:00 +0000 A prompt is production configuration that changes behaviour silently. Treat it like code, and build the smallest evaluation that can tell you whether a change made things better. AutomationLLMs and agents https://consultoria.com/blog/aws-rds-aurora-migration https://consultoria.com/blog/aws-rds-aurora-migration Tue, 11 Aug 2026 00:00:00 +0000 Aurora is not automatically better or cheaper. It wins on specific axes, loses on others, and the migration has one path that keeps downtime under a minute. Here is the decision and the runbook. AWS https://consultoria.com/blog/rpa-vs-api-first-automation https://consultoria.com/blog/rpa-vs-api-first-automation Mon, 10 Aug 2026 00:00:00 +0000 An agent that clicks through a web interface can automate systems that have no API at all. It is also the most fragile automation you can build. Where the trade actually lands, and how to make the fragile version survive. Automation https://consultoria.com/blog/iso-27017-27018-cloud-privacy https://consultoria.com/blog/iso-27017-27018-cloud-privacy Sun, 09 Aug 2026 00:00:00 +0000 Two supplementary standards that extend ISO 27001 into cloud services and personal data in the cloud. What each adds, who actually asks for them, and how much extra audit they cost. Compliance https://consultoria.com/blog/automation-rollout-90-days https://consultoria.com/blog/automation-rollout-90-days Sat, 08 Aug 2026 00:00:00 +0000 Not a strategy deck. A sequence: find the work, ship one thing that matters, build the platform underneath it, then let other people build. What goes wrong at each stage and how to tell if it is working. Automation https://consultoria.com/blog/aws-vpc-networking-mistakes https://consultoria.com/blog/aws-vpc-networking-mistakes Fri, 07 Aug 2026 00:00:00 +0000 Networking mistakes in AWS are the expensive kind, because fixing them means moving workloads. These six come up in almost every estate we review, and five of them are cheap to get right on day one. AWS https://consultoria.com/blog/ens-certification-spain https://consultoria.com/blog/ens-certification-spain Wed, 05 Aug 2026 00:00:00 +0000 The Esquema Nacional de Seguridad is not optional if you want public sector contracts in Spain. How the categories work, what the 2022 revision changed, and where a cloud-native company usually fails. Compliance https://consultoria.com/blog/gcp-project-hierarchy-org-policies https://consultoria.com/blog/gcp-project-hierarchy-org-policies Mon, 03 Aug 2026 00:00:00 +0000 In GCP the project is the blast radius and the folder is where policy lives. Most estates we see have neither used deliberately. Here is the structure we deploy and the eight policies we set on day one. Google CloudTerraform https://consultoria.com/blog/nis2-scope-and-obligations https://consultoria.com/blog/nis2-scope-and-obligations Sat, 01 Aug 2026 00:00:00 +0000 NIS2 pulled in far more companies than its predecessor, added personal liability for management, and set a 24-hour first notification. What the directive actually requires, in engineering terms. Compliance https://consultoria.com/blog/gcp-bigquery-cost-control https://consultoria.com/blog/gcp-bigquery-cost-control Thu, 30 Jul 2026 00:00:00 +0000 On-demand BigQuery charges for bytes scanned, so one badly written dashboard can cost more than your compute. Here is how we cap it without slowing anyone down. Google CloudFinOps https://consultoria.com/blog/soc2-evidence-automation https://consultoria.com/blog/soc2-evidence-automation Tue, 28 Jul 2026 00:00:00 +0000 A Type II window means proving, month after month, that controls ran. Collecting that by hand consumes an engineer. What to automate, what to buy, and what still has to be done by a person. Compliance https://consultoria.com/blog/gcp-iam-conditions-service-accounts https://consultoria.com/blog/gcp-iam-conditions-service-accounts Sun, 26 Jul 2026 00:00:00 +0000 Almost every Google Cloud incident we have investigated started with a JSON key file. Workload Identity Federation removes the need for them entirely, and the migration is smaller than you think. Google CloudIdentity and access https://consultoria.com/blog/soc2-type-1-vs-type-2 https://consultoria.com/blog/soc2-type-1-vs-type-2 Fri, 24 Jul 2026 00:00:00 +0000 Type I is a photograph, Type II is a film. The choice changes your timeline by months and what a customer will accept. How to pick, how long each takes, and where the money goes. Compliance https://consultoria.com/blog/gcp-gke-autopilot-vs-standard https://consultoria.com/blog/gcp-gke-autopilot-vs-standard Wed, 22 Jul 2026 00:00:00 +0000 Autopilot charges for what your pods request and removes node management. That is a better deal than it sounds for most teams and a worse one for a few. Here is how to tell which you are. Google CloudKubernetes https://consultoria.com/blog/iso-27001-statement-of-applicability https://consultoria.com/blog/iso-27001-statement-of-applicability Mon, 20 Jul 2026 00:00:00 +0000 Most ISO 27001 projects write the SoA last, as a spreadsheet of 93 rows marked "applicable". Done properly it falls out of the risk assessment, and it is what makes the rest of the audit go quickly. Compliance https://consultoria.com/blog/gcp-vertex-ai-rag-production https://consultoria.com/blog/gcp-vertex-ai-rag-production Sat, 18 Jul 2026 00:00:00 +0000 Vertex gives you a managed vector search, a grounding API and an evaluation service. Two of those are worth taking as-is. Here is how we assemble a production assistant on Google Cloud. Google CloudRAG https://consultoria.com/blog/iso-27001-annex-a-controls-cloud https://consultoria.com/blog/iso-27001-annex-a-controls-cloud Thu, 16 Jul 2026 00:00:00 +0000 A company running entirely on managed cloud services already satisfies a large part of Annex A without knowing it. The work is evidencing that, and finding the dozen controls that genuinely need building. Compliance https://consultoria.com/blog/gcp-cloud-run-vs-gke https://consultoria.com/blog/gcp-cloud-run-vs-gke Tue, 14 Jul 2026 00:00:00 +0000 Most teams running GKE would be better served by Cloud Run, and a few running Cloud Run are fighting it. The decision is not about scale — it is about four specific requirements. Google CloudKubernetes https://consultoria.com/blog/wazuh-open-source-siem https://consultoria.com/blog/wazuh-open-source-siem Sun, 12 Jul 2026 00:00:00 +0000 An open-source SIEM is a real option when the alternative is paying per gigabyte, but only if you accept the operational cost. What Wazuh gives you out of the box, what you have to build, and when to stop and buy. Pentesting toolsCompliance https://consultoria.com/blog/gcp-scc-findings-triage https://consultoria.com/blog/gcp-scc-findings-triage Fri, 10 Jul 2026 00:00:00 +0000 SCC Premium turns on and produces thousands of findings in an hour. Here is the triage order that gets an estate from "unreadable" to "twelve open items" in about three weeks. Google CloudCompliance https://consultoria.com/blog/bloodhound-identity-attack-paths https://consultoria.com/blog/bloodhound-identity-attack-paths Wed, 08 Jul 2026 00:00:00 +0000 Identity is where the escalation happens, and graphs are how you see it. What BloodHound reveals about Active Directory and Entra ID, how to read the paths, and which edges are worth cutting first. Pentesting toolsIdentity and access https://consultoria.com/blog/gcp-committed-use-discounts https://consultoria.com/blog/gcp-committed-use-discounts Mon, 06 Jul 2026 00:00:00 +0000 CUDs come in two flavours that behave very differently, and buying the wrong one locks you to a machine family for three years. Here is the sequence we follow. Google CloudFinOps https://consultoria.com/blog/osv-scanner-sbom-supply-chain https://consultoria.com/blog/osv-scanner-sbom-supply-chain Sat, 04 Jul 2026 00:00:00 +0000 Dependency scanning is mature; what changed is that customers and regulators now ask for the inventory itself. How to generate SBOMs that are useful rather than ceremonial, and how to answer "are we affected?" in an hour. Pentesting toolsCompliance https://consultoria.com/blog/gcp-vpc-service-controls https://consultoria.com/blog/gcp-vpc-service-controls Thu, 02 Jul 2026 00:00:00 +0000 IAM stops the wrong people reading your data. It does not stop the right people copying it somewhere else. Service perimeters do, and they will break things on the way in. Here is how to roll one out without an outage. Google CloudCompliance https://consultoria.com/blog/gitleaks-trufflehog-secret-scanning https://consultoria.com/blog/gitleaks-trufflehog-secret-scanning Tue, 30 Jun 2026 00:00:00 +0000 Finding a credential in git history is the easy part. The hard parts are verifying it is live, rotating it without an outage, and stopping the next one — in that order, and usually within the hour. Pentesting toolsIdentity and access https://consultoria.com/blog/gcp-terraform-google-provider https://consultoria.com/blog/gcp-terraform-google-provider Sun, 28 Jun 2026 00:00:00 +0000 The google provider has behaviours that will surprise you the first time — authoritative IAM resources that wipe bindings, projects that will not delete, APIs that must be enabled before anything works. Here is the setup we use. Google CloudTerraform https://consultoria.com/blog/trivy-grype-container-scanning https://consultoria.com/blog/trivy-grype-container-scanning Fri, 26 Jun 2026 00:00:00 +0000 Every image scan returns hundreds of CVEs and almost none of them are reachable. How we cut the list down to what is exploitable, where each tool is stronger, and why the base image is the whole game. Pentesting toolsKubernetes https://consultoria.com/blog/azure-landing-zone-management-groups https://consultoria.com/blog/azure-landing-zone-management-groups Wed, 24 Jun 2026 00:00:00 +0000 The Cloud Adoption Framework reference architecture is large and most teams deploy a fraction of it. Here is the subset that carries the weight: management groups, subscription boundaries and the policies that hold it together. AzureTerraform https://consultoria.com/blog/semgrep-sast-developers-use https://consultoria.com/blog/semgrep-sast-developers-use Mon, 22 Jun 2026 00:00:00 +0000 Most static analysis dies from noise. The way to keep SAST alive is to start with a tiny high-precision rule set, write rules for your own codebase's mistakes, and scan the diff rather than the repository. Pentesting tools https://consultoria.com/blog/azure-entra-id-conditional-access https://consultoria.com/blog/azure-entra-id-conditional-access Sat, 20 Jun 2026 00:00:00 +0000 Conditional Access is the strongest control in Entra ID and the easiest way to lock your entire organisation out of its own tenant. Here is the baseline set, and the order to deploy it in. AzureIdentity and access https://consultoria.com/blog/zap-dast-in-ci https://consultoria.com/blog/zap-dast-in-ci Thu, 18 Jun 2026 00:00:00 +0000 Dynamic scanning in a pipeline fails for predictable reasons: no authentication, no seeded data, a scan that takes forty minutes and a threshold that fails builds on informational alerts. How to configure ZAP so the result is trusted. Pentesting tools https://consultoria.com/blog/azure-cost-management-reservations https://consultoria.com/blog/azure-cost-management-reservations Tue, 16 Jun 2026 00:00:00 +0000 Azure has more discount mechanisms than any other cloud and they stack in a specific order. Get the order wrong and you commit to capacity a hybrid benefit would have made unnecessary. AzureFinOps https://consultoria.com/blog/nuclei-continuous-attack-surface https://consultoria.com/blog/nuclei-continuous-attack-surface Sun, 14 Jun 2026 00:00:00 +0000 Nuclei is fast enough to run against your whole external surface every night. The value is in the template selection, the target list and the diff between runs, not in the raw number of findings. Pentesting tools https://consultoria.com/blog/azure-aks-production-checklist https://consultoria.com/blog/azure-aks-production-checklist Fri, 12 Jun 2026 00:00:00 +0000 Network plugin, identity model, node pool layout and upgrade strategy are all chosen in the first hour and all painful to change afterwards. Here is what we pick and why. AzureKubernetes https://consultoria.com/blog/burp-suite-web-assessment https://consultoria.com/blog/burp-suite-web-assessment Wed, 10 Jun 2026 00:00:00 +0000 The scanner is the least interesting part of Burp. This is how we set up scope, authentication and session handling for a web application assessment, which extensions earn their place, and how to tell a finding from a false positive. Pentesting tools https://consultoria.com/blog/azure-openai-rag-production https://consultoria.com/blog/azure-openai-rag-production Mon, 08 Jun 2026 00:00:00 +0000 The model is the easy part. What decides whether an Azure OpenAI assistant reaches production is token quota per region, private networking and whether retrieval respects who is asking. AzureRAG https://consultoria.com/blog/nmap-recon-cloud-perimeter https://consultoria.com/blog/nmap-recon-cloud-perimeter Sat, 06 Jun 2026 00:00:00 +0000 Nmap still finds the things that matter on a cloud perimeter, but only if you scan the right address space with the right flags. How we build the target list, which scan types earn their time, and how to read the output without wasting a week. Pentesting toolsAWS https://consultoria.com/blog/azure-defender-cloud-secure-score https://consultoria.com/blog/azure-defender-cloud-secure-score Thu, 04 Jun 2026 00:00:00 +0000 Defender has eight separately priced plans and a score that rewards volume over risk. Here is how we decide which plans earn their cost and how to triage the recommendations that matter. AzureCompliance https://consultoria.com/blog/azure-private-endpoints-networking https://consultoria.com/blog/azure-private-endpoints-networking Sun, 31 May 2026 00:00:00 +0000 Locking down PaaS services in Azure is straightforward until the name resolution breaks in a way that only shows up from one subnet. Here is the model that works and how to lay out the hub. Azure https://consultoria.com/blog/azure-policy-as-code https://consultoria.com/blog/azure-policy-as-code Wed, 27 May 2026 00:00:00 +0000 Azure Policy is the strongest governance engine of the three big clouds and the easiest to misuse. Here is how we write, test and roll out policy so a Deny effect never surprises a deployment. AzureCompliance https://consultoria.com/blog/azure-sql-vs-managed-instance https://consultoria.com/blog/azure-sql-vs-managed-instance Sat, 23 May 2026 00:00:00 +0000 The three options differ on features, cost and how much of your existing database you have to change. Here is the decision tree and the migration that keeps downtime short. Azure https://consultoria.com/blog/azure-bicep-vs-terraform https://consultoria.com/blog/azure-bicep-vs-terraform Tue, 19 May 2026 00:00:00 +0000 Bicep is better at Azure than Terraform in several specific ways, and worse in several others. The right answer depends on whether Azure is your only cloud and who maintains the code. AzureTerraform https://consultoria.com/blog/oci-compartments-tenancy-design https://consultoria.com/blog/oci-compartments-tenancy-design Fri, 15 May 2026 00:00:00 +0000 Oracle Cloud puts everything in one tenancy and separates it with compartments. That is a different model from AWS accounts or Azure subscriptions, and copying either one produces a mess. Oracle Cloud https://consultoria.com/blog/oci-iam-policies-dynamic-groups https://consultoria.com/blog/oci-iam-policies-dynamic-groups Mon, 11 May 2026 00:00:00 +0000 An OCI policy statement is one readable line, and one readable line can grant far more than it appears to. Here is how we write, verify and constrain them. Oracle CloudIdentity and access https://consultoria.com/blog/oci-cost-model-vs-aws https://consultoria.com/blog/oci-cost-model-vs-aws Thu, 07 May 2026 00:00:00 +0000 OCI prices egress and compute differently enough that a like-for-like comparison with AWS misleads in both directions. Here is what genuinely moves and how we model it. Oracle CloudFinOps https://consultoria.com/blog/oci-oke-kubernetes-production https://consultoria.com/blog/oci-oke-kubernetes-production Sun, 03 May 2026 00:00:00 +0000 Oracle's managed Kubernetes is closer to the others than people expect, with three genuine differences: the free control plane, the ARM allowance and a networking model you choose at creation. Oracle CloudKubernetes https://consultoria.com/blog/oci-autonomous-database https://consultoria.com/blog/oci-autonomous-database Wed, 29 Apr 2026 00:00:00 +0000 It genuinely removes patching, tuning and backup configuration. It does not remove schema design, connection management or the need to understand what your queries do. Here is where it fits. Oracle Cloud https://consultoria.com/blog/oci-cloud-guard-security-zones https://consultoria.com/blog/oci-cloud-guard-security-zones Sat, 25 Apr 2026 00:00:00 +0000 Most cloud security products tell you what went wrong. Security Zones refuse the misconfiguration at creation. That is a meaningful difference, and it is the OCI feature worth building around. Oracle CloudCompliance https://consultoria.com/blog/oci-networking-vcn-fastconnect https://consultoria.com/blog/oci-networking-vcn-fastconnect Tue, 21 Apr 2026 00:00:00 +0000 A VCN looks like a VPC until you meet the four gateway types and two firewall models. Here is the layout we build and the specific choices that avoid rework. Oracle Cloud https://consultoria.com/blog/oci-generative-ai-service https://consultoria.com/blog/oci-generative-ai-service Fri, 17 Apr 2026 00:00:00 +0000 Oracle's managed model service covers the plumbing for a standard assistant, including a vector-capable database you probably already have. Here is the architecture and the decisions it does not make for you. Oracle CloudLLMs and agents https://consultoria.com/blog/oci-terraform-resource-manager https://consultoria.com/blog/oci-terraform-resource-manager Mon, 13 Apr 2026 00:00:00 +0000 Oracle ships a managed Terraform service that removes the backend and the runner. Here is when it is the right call, when to run your own pipeline, and the OCI-specific things that catch people. Oracle CloudTerraform https://consultoria.com/blog/oci-migration-from-aws https://consultoria.com/blog/oci-migration-from-aws Thu, 09 Apr 2026 00:00:00 +0000 Most services have a counterpart and the translation is mechanical. Three things are not mechanical, and they decide whether the migration is worth doing at all. Oracle Cloud