https://jesusoseguera.dev/tags/aws/Recent content in Aws on Jesus OsegueraHugoen-usWed, 01 Jul 2026 00:00:00 +0000https://jesusoseguera.dev/projects/eks-gitops/Wed, 01 Jul 2026 00:00:00 +0000https://jesusoseguera.dev/projects/eks-gitops/Overview Built a CI/CD security pipeline for AWS EKS with no long-lived cloud credentials in the system. GitHub Actions authenticates to AWS through OIDC/IRSA, every deployment is gated behind a 10-stage DevSecOps pipeline, and runtime detection is covered with Falco plus timed drills whose results feed a shared metrics schema in CI. Technologies: Terraform, AWS EKS, ArgoCD, GitHub Actions, Cosign/Sigstore, OPA Gatekeeper, Falco, Argo Rollouts, Prometheus, Grafana Features Zero long-lived AWS credentials in CI: GitHub Actions to AWS via OIDC, ArgoCD to the cluster via IRSA 10-stage pipeline: secret scanning, SAST, SCA, IaC scanning, and container CVE scanning before promote Keyless image signing with Cosign/Sigstore and SBOMs attached as attestations Progressive canary delivery with Argo Rollouts, promoted or rolled back from Prometheus success-rate and latency metrics OPA Gatekeeper admission policy cluster-wide Falco 0.