01Field Notes

The work, written
up honestly.

No thought-leadership. These are real systems I designed and shipped, republished from awsgrub.com. If you want to know how I think, read the work.

Latest · Automation·7 min

Your Golden AMI Is a Fugazi. Put In the (Step) Functions to Make It Real Gold.

A Step Functions pipeline that patches a hardened golden AMI on the 1st of every month: temp instance, SSM patching, re-encryption under an org-wide KMS key, shared via RAM. Zero manual steps.

Read note

Security11 min

My SIEM Tries to Talk Itself Out of Paging Me

An EventBridge-first SIEM for an AWS org where a second model pass on Bedrock tries to refute every alert before it pages a human. Fewer 2 AM pages, better signal.

Security11 min

Weekly AWS Security Posture Pipeline with Prowler, ECS Fargate, and Claude

Every Sunday, an ECS task scans every account in the org with Prowler, and an AI-written summary lands in Confluence and the team's inbox on Monday morning.

AI9 min

A Morning Brief System for Parallel Workstreams

A Python + LLM brief that reads per-project status files and emails leadership one scannable update each morning, so quieter workstreams stop disappearing.

Cloud8 min

Mounting EFS Cross-Account from a Spoke VPC via Transit Gateway

Cross-account EFS from a spoke VPC has three friction points: DNS that won't resolve, a TLS-enforcing resource policy, and a root-squashed filesystem. The pattern that works.