Cloud Docs
Plain-language explanations of the policy constructs and security controls that shape cloud environments, and how they fit together.
- AWS Declarative Policies vs SCPs: What's the Difference?SCPs control what principals can do. Declarative Policies enforce what a service configuration must always look like. Different layers, different jobs.
- AWS IAM Permission Boundaries Explained: What They Do and How to Set Them UpA permissions boundary caps what an IAM role can ever be granted. How the intersection works, and the three steps that close the privilege escalation path.
- AWS RCP Support by Service: What's Covered Today (S3, Control Tower, and More)The 44 AWS service entries that support RCPs today, what each one enforces, which have Control Tower managed controls, and where you still need an SCP instead.
- AWS RCP vs SCP: What's the Difference and Which One Do You Need?SCPs cap what your principals can do. RCPs cap what your resources will accept. The decision framework, the evaluation order, and where teams conflate the two.
- AWS Resource Control Policies (RCPs) Explained: What They Are and How They WorkRCPs are the resource half of an AWS data perimeter. What they control, how they evaluate alongside SCPs and bucket policies, and which services support them.
- AWS Tag Policies and Backup Policies Explained: Governing Resources Across Your OrganizationTag policies standardize tag keys and values across accounts. Backup policies apply backup plans org-wide. What each enforces, and where each one stops.
- GCP IAM Conditions Explained: Syntax, CEL Examples, and Use CasesMost misconfigured IAM Conditions fail without an error. The CEL attributes that work, examples for time, resource type, and tags, and the traps to avoid.
- GCP Organization Policy vs IAM: What Each One Actually ControlsIAM decides who can act. Organization Policy decides what the environment permits at all, admins included. The decision framework, and how to layer both.
- How to Deploy AWS Declarative Policies with Terraform and the CLIA tested Terraform and AWS CLI walkthrough: enable the policy type, write the attribute document, attach it, then verify with the account status report.
- Permission Boundary vs IAM Policy: What Actually Controls AccessAn IAM policy grants access. A permission boundary caps what any policy can grant. Effective permissions are the intersection. Which one to reach for, and when.