Aws on DevOps & Rock'N'Roll

Letting Claude loose on an AWS account with Prowler

Tue, 11 Aug 2026 00:08:30 +0000

I had been meaning to run a proper security audit of one of our AWS accounts for months. The task kept losing to more urgent things, because it isn’t a single job — it’s install a scanner, work out its permissions, run it for an hour, then read several thousand findings and decide which twelve actually matter.

So I gave the whole thing to Claude Code and watched. The interesting part wasn’t that it worked; it was where the effort actually went.

Karpenter consolidation without the pager fatigue

Tue, 16 Jun 2026 00:08:30 +0000

Karpenter’s consolidation is the feature that pays for the migration. It watches your cluster, notices that the workload fits on cheaper capacity, and rearranges the nodes to match. On a fleet running mostly spot, the savings are real and continuous — when I went through the cost optimisation exercise, it was one of the few changes that measurably moved the bill.

It is also a machine that deliberately deletes your nodes, all day, forever. If your workloads aren’t ready for that, consolidation turns into a steady drip of alerts that eventually teaches everyone to ignore the alerting channel — which is a worse outcome than paying for the oversized nodes.

IRSA to Pod Identity: notes from the migration

Tue, 02 Jun 2026 00:08:30 +0000

IRSA has been the way to give a Kubernetes pod an AWS identity since 2019, and it works. It also requires an OIDC provider per cluster, a trust policy per role that names a specific cluster’s OIDC issuer, and a mental model involving projected service account tokens that you re-derive from scratch every time something breaks.

EKS Pod Identity does the same job with less machinery. I’ve now moved a few clusters over and it’s mostly good news, with a couple of edges worth knowing before you start.

Terragrunt: deleting the boilerplate you were told to write

Tue, 19 May 2026 00:08:30 +0000

Terragrunt exists to keep you DRY, and then you open a mature Terragrunt repository and find ninety terragrunt.hcl files that are eighty percent identical. There’s a joke in there somewhere.

It isn’t Terragrunt’s fault. The default onboarding path — copy the folder next door, change the inputs — is the fastest way to a working stack and the slowest way to a maintainable one. Here’s what I strip out when I inherit one of these.

EKS Access Entries: one ARN, one cluster, no sharing

Tue, 21 Apr 2026 00:08:30 +0000

EKS Access Entries replaced the aws-auth ConfigMap and made cluster authorization a proper AWS API object instead of a YAML blob that you edited with trembling hands, hoping you wouldn’t lock yourself out. It’s a genuine improvement. But moving auth into the API surface also moves it into Terraform state, and that’s where it gets interesting.

The error that sent me down this road:

Error: creating EKS Access Entry (test-spain-001:arn:aws:iam::123456789012:role/PlatformAdmin):
ResourceInUseException: The specified access entry resource is already in use
on this cluster.

My first reaction was the wrong one: are access entries global? Did creating one for cluster A break cluster B?

Fargate profiles and the art of waiting your turn

Tue, 07 Apr 2026 00:08:30 +0000

There is a special kind of Terraform error that only shows up when you destroy things. Your apply has been green for months, everyone is happy, and then one day you run a terragrunt destroy on a test cluster and get this:

Error: deleting EKS Fargate Profile (test-spain-001:test-spain-001-karpenter-2a):
operation error EKS: DeleteFargateProfile, https response error StatusCode: 409,
ResourceInUseException: Cannot delete Fargate profile
test-spain-001-karpenter-2a because cluster test-spain-001 currently has
Fargate profile test-spain-001-karpenter-2b in status DELETING

Run it again — it works. Run it on the next cluster — it fails again. Welcome to the club.

Cutting the EKS bill: what actually moved the needle

Tue, 15 Jul 2025 00:08:30 +0000

Every cost optimisation article opens with a list of twenty things you should do. Most of them save single-digit percentages and cost you a week each. This is the shorter, more honest version: the things that actually changed my EKS bill, roughly in order of return per hour of effort, and the ones that didn’t.

Context so the numbers mean something: three clusters, a few hundred pods, mixed prod and dev, one region, Karpenter-managed nodes.