Ideas worth documenting.
Technical journals, practical lessons, and the reasoning behind the work. Written as I build and learn.
Building a NIS2-Compliant AWS Landing Zone
An open-source AWS landing zone in Terraform, mapped explicitly to NIS2 Article 21 and ISO 27001:2022 Annex A — built in public, module by module, over six weeks.
Explore series 6 of 7 parts publishedNotes, experiments & ideas.
Building an Entra Conditional Access library
Writing policies is easy. Proving they respond to real events is the part that matters, so I built a monitoring layer. Entra sign-in and audit logs flow into a Log Analytics workspace, and Microsoft Sentinel sits on top with KQL detections tied to the patterns.
Read articleBuilding a NIS2-Compliant AWS Landing Zone — Documentation
Week 5 was about turning that into something a reviewer could actually read — and closing the last measure, which turned out not to be a module at all.
Read articleBuilding a NIS2-Compliant AWS Landing Zone - Detection
Everything so far has been about evidence and control: logs that can't be switched off, guardrails that can't be bypassed. But a landing zone that only records and restricts is still passive. Week 4 adds the active half — threat detection that generates findings, a place those findings aggregate and get scored, and one channel that turns a finding into a notification.
Read articleBuilding a NIS2-Compliant AWS Landing Zone - Identity Foundations
Last week I built the three audit trails — API, configuration, and network — all encrypted, all mapped to NIS2 measures, all streaming somewhere useful. Everything that happens in this account now gets recorded. This week answers the next question: who's actually allowed to make things happen, and what stops them from turning the recording off?
Read articleBuilding a NIS2-Compliant AWS Landing Zone - The Logging Layer
Previously in this series: Week 1 poured the foundation — a KMS key and a secure-by-default S3 bucket, composed through a clean interface, with native `terraform test` and a full CI pipeline behind branch protection. This week builds the layer every incident investigation depends on: the logs.
Read articleBuilding a NIS2-Compliant AWS Landing Zone — Week 1: Foundations
KMS and S3 baseline modules, native terraform test, the full CI pipeline, and branch protection — the groundwork everything else builds on.
Read articleBuilding a NIS2-Compliant AWS Landing Zone — Week 0: Why I'm Doing This
On 17 October 2024 the EU's NIS2 Directive came into force — yet eighteen months later, almost no public Terraform examples mention it by name. This series fills that gap: an AWS landing zone mapped to NIS2 and ISO 27001, built in public over six weeks.
Read article