Amazon Cognito Practical Introduction Reference Information Summary

Reference material — an ebook and AWS Amplify's tutorial — for getting hands-on with Amazon Cognito.

Amazon S3 AccessDenied Error with Only arn:aws:s3:::bucket Setting

Fixing an S3 AccessDenied error by adding the object ARN `arn:aws:s3:::bucket/*` alongside the bucket ARN.

Summary of Articles Referenced When Considering Auth0 Adoption

A curated link list of articles I referenced when evaluating Auth0 for adoption, grouped by topic.

Auth0 Pricing Estimation [BtoC Edition]

Estimating Auth0's Developer plan cost for a BtoC service and thinking through whether the per-user pricing fits.

Auth0 Custom Domain DNS Record Reflection Time is About 5 Minutes

Auth0's custom domain verified about five minutes after adding the CNAME record in Route53.

How to Change Auth0 Login Session Expiration Time

How to change Auth0 login session expiration — the defaults for Inactivity timeout and Require log in after, and where to change them.

The Difference Between Authentication and Authorization

A quick memo on an ITmedia article and diagram that clearly explain authentication vs. authorization.

Letting AI Agents Use the AWS CLI Safely — A 2026 Defense-in-Depth Design That Disarms Any Single Credential

Hand an AI agent a shell and AWS credentials at the same time, and a single prompt injection can translate straight into deleted cloud resources or exfiltrated secrets. IAM Identity Center plus ReadOnlyAccess is the right starting direction. But ReadOnlyAccess is not 'read-only equals safe,' and tool-side deny rules do not survive adversarial evasion. Working from the premise that the only trustworthy enforcement boundaries are IAM and OS sandboxes, we layer defenses across authentication, authorization, execution, approval, and audit so that seizing a repository or a shell alone never reaches production.

How to Create Access Keys for AWS IAM PowerUser

Two approaches to letting an AWS IAM PowerUser create AWS CLI access keys.

Password Reset Required for First Root Account Login After Creating New Account in AWS Organizations

How to perform the initial root login on a new AWS Organizations member account by resetting the initial password.

AWS Account Management Policy Comparison - AWS Organizations vs IAM Switch Role

Pros and cons of AWS Organizations vs IAM Switch Role for managing multiple AWS accounts.

Using DefaultCredentialsProvider Instead of ProfileCredentialsProvider [AWS SDK for Java]

Switching AWS SDK for Java from `ProfileCredentialsProvider` to `DefaultCredentialsProvider` and its benefits.

AWS S3 Sample Code for credentialProvider Considering IAM Role [AWS SDK for JavaScript]

TypeScript sample for an IAM-role-aware S3 credentialProvider setup, including a minio-compatible variant.

Cloud Identity Free Edition Registration Method

How to sign up for Cloud Identity Free Edition to create a GCP organization without Google Workspace.

G Suite Administrator Post-Implementation Configuration Checklist

A post-deployment G Suite admin checklist — security, end-user access, Drive sharing, and email hardening.

Letting AI Agents Use the Google Cloud CLI Safely — Drop the Keys, Lock It Down with Impersonation and a Command Broker

Hand an AI agent a shell and Google Cloud credentials at the same time, and a single prompt injection can turn into a misfired gcloud command that escalates privileges or exfiltrates data. Short-lived credentials and least privilege, which is Google's official guidance, are the right direction. But service account keys persist dangerously when leaked, and tool-side deny rules do not survive adversarial evasion. Working from the premise that the only trustworthy enforcement boundaries are IAM, organization policy, and OS sandboxes, we layer defenses across authentication, authorization, execution, approval, and audit so that seizing a single input never reaches production.

Using IAM Roles in GitHub Actions Without Passing AWS Credentials Directly

A reference article on assuming AWS IAM Roles from GitHub Actions without long-lived credentials.

IAM and Resource Management to Check First After Adopting Google Cloud Organization — Preventing Project Sprawl and Personal-Account Dependencies

The moment you finish provisioning a Google Cloud Organization linked to Google Workspace or Cloud Identity, the entire domain has Project Creator and Billing Account Creator by default. That default exists so the first admin cannot lock themselves out, and it is not a recommended steady state. If you leave it, you end up with 'My First Project' scattered directly under the Organization, external services still authenticating as former employees via OAuth, and billing no one can trace. This post walks through the IAM to inspect on day one, a safe procedure to narrow the roles without cutting yourself off, folder and naming conventions, cautions when moving existing projects into folders, angles for auditing external-service integrations, and a checklist you can hand to the next admin who joins the team.

Granting Google Cloud Access by Team — Access Groups and Folders as Two Axes

"Folders or group addresses?" is a false choice. Folders scope permissions, groups identify principals, and the right design uses both axes together.

How to Create a Microsoft Azure Account and Initial Setup

Preliminary steps for adopting Microsoft Azure at a company — from Microsoft account creation and MFA to the Azure account itself.

Smaregi 'Transaction History CSV Download' Function Can Be Used with [Transaction History Function All] Permission Setting

Smaregi's Transaction History CSV Download requires the [4 Transaction History Function All] permission.