Blog
trueno blog AWS cloud intelligence notes.
Practical writing on AWS security, cost, IAM, and posture management, plus the engineering decisions behind trueno. Technical, specific, and honest about the tradeoffs.
AWS External ID Explained: The Confused Deputy Problem in Plain English
External ID is a small field in an IAM trust policy that carries a lot of weight. Here is what it does, how it prevents the confused deputy problem, and why a SaaS should generate it for you instead of letting you type any value.
Why Your AWS Security Tool Should Use Read-Only AssumeRole, Not Access Keys
Long-lived access keys are the wrong default for a product that connects to production. Here is why read-only STS AssumeRole, external ID protection, and metadata-only scanning are the minimum trust model for an AWS posture tool.