Removing the step where customers type their AWS account number — a CloudFormation custom resource that mails the role ARN to an SNS topic, an SQS buffer, a server that treats the notice as a hint and proves it by assuming the role, and the replies, retries and open-mailbox risks that come with it.
Connecting a customer’s EKS cluster without taking any long-lived key — a per-team ExternalId against the confused deputy, a role template that can only register itself into chosen namespaces, the k* pattern that slipped past a kube-* deny, 15-minute tokens, and the address check that blocks private endpoints.
Moving the VPC and Aurora that predated Terraform out of a CloudFormation stack — how fourteen resources split into two roots, the two apply roles built for them, and the IAM gaps that eight review rounds found before anything was applied.
How a develop merge in each app repo becomes exactly one image in ECR — a role that can push to one repository only, a commit-SHA tag that never moves so the job checks before it builds, a build cache that silently never saved, and a digest a person still copies into the manifest by hand.
Standing up the EKS cluster on top of the comment-approved pipeline — a NAT instance that costs a quarter of the gateway, three applies to finish one plan, an input that leaks into the next plan, and ArgoCD installed once from outside with every other Application kept in Git.
Keeping a deploy robot from growing its own power — short-lived OIDC credentials instead of stored keys, a permissions boundary on every role it creates, permission and creation split into two PRs, and EKS access entries as one line in the cluster’s roster.
How a three-person team made Terraform changes go through review and a PR comment — the deploy-config repo split off like a parcel box, plan and apply as two different badges, and one saved plan applied exactly once.
EC2 인스턴스가 자기 정보와 IAM 역할 자격 증명을 읽어 오는 링크 로컬 주소 169.254.169.254 의 서비스. 컨테이너가 이 주소에 닿으면 노드의 AWS 권한을 가져갈 수 있다.