https://kukie.tech/tags/iam/Recent content in Iam on HistoryHugoko-krMon, 19 Oct 2026 15:00:00 +0900https://kukie.tech/posts/kukie-infra-08/Mon, 19 Oct 2026 15:00:00 +0900https://kukie.tech/posts/kukie-infra-08/Removing the step where customers type their AWS account number — a CloudFormation custom resource that mails the role ARN to an SNS topic, an SQS buffer, a server that treats the notice as a hint and proves it by assuming the role, and the replies, retries and open-mailbox risks that come with it.https://kukie.tech/posts/kukie-infra-07/Mon, 19 Oct 2026 13:00:00 +0900https://kukie.tech/posts/kukie-infra-07/Connecting a customer’s EKS cluster without taking any long-lived key — a per-team ExternalId against the confused deputy, a role template that can only register itself into chosen namespaces, the k* pattern that slipped past a kube-* deny, 15-minute tokens, and the address check that blocks private endpoints.https://kukie.tech/posts/kukie-infra-06/Fri, 16 Oct 2026 13:00:00 +0900https://kukie.tech/posts/kukie-infra-06/Moving the VPC and Aurora that predated Terraform out of a CloudFormation stack — how fourteen resources split into two roots, the two apply roles built for them, and the IAM gaps that eight review rounds found before anything was applied.https://kukie.tech/posts/kukie-infra-02/Wed, 14 Oct 2026 09:10:00 +0900https://kukie.tech/posts/kukie-infra-02/Keeping a deploy robot from growing its own power — short-lived OIDC credentials instead of stored keys, a permissions boundary on every role it creates, permission and creation split into two PRs, and EKS access entries as one line in the cluster’s roster.https://kukie.tech/posts/kukie-infra-01/Wed, 14 Oct 2026 09:00:00 +0900https://kukie.tech/posts/kukie-infra-01/How a three-person team made Terraform changes go through review and a PR comment — the deploy-config repo split off like a parcel box, plan and apply as two different badges, and one saved plan applied exactly once.https://kukie.tech/wiki/imds/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/imds/EC2 인스턴스가 자기 정보와 IAM 역할 자격 증명을 읽어 오는 링크 로컬 주소 169.254.169.254 의 서비스. 컨테이너가 이 주소에 닿으면 노드의 AWS 권한을 가져갈 수 있다.