https://kukie.tech/tags/least-privilege/Recent content in Least-Privilege on HistoryHugoko-krMon, 19 Oct 2026 13:00:00 +0900https://kukie.tech/posts/kukie-infra-07/Mon, 19 Oct 2026 13:00:00 +0900https://kukie.tech/posts/kukie-infra-07/Connecting a customer’s EKS cluster without taking any long-lived key — a per-team ExternalId against the confused deputy, a role template that can only register itself into chosen namespaces, the k* pattern that slipped past a kube-* deny, 15-minute tokens, and the address check that blocks private endpoints.https://kukie.tech/posts/kukie-infra-06/Fri, 16 Oct 2026 13:00:00 +0900https://kukie.tech/posts/kukie-infra-06/Moving the VPC and Aurora that predated Terraform out of a CloudFormation stack — how fourteen resources split into two roots, the two apply roles built for them, and the IAM gaps that eight review rounds found before anything was applied.https://kukie.tech/posts/kubernetes-patterns-23/Mon, 24 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-23/검사는 언젠가 뚫린다고 가정하고, securityContext 7종 세트로 프로세스를 최소 권한의 울타리에 가둔 뒤, PSS/PSA 정책으로 그 울타리를 클러스터 차원에서 강제하는 법.