Sam Howard

A SPIFFE/SPIRE control plane on Amazon EKS, built to emulate a restricted U.S. Army "Private Only" cloud. It replaces long-lived static credentials with short-lived identity that rotates itself.

• Deployed a SPIRE workload-identity control plane on EKS, issuing X.509 SVIDs with roughly four-hour TTLs in place of static secrets.
• Attestation runs in two tiers. EC2 node attestation first, then workload attestation through Kubernetes projected service-account tokens (k8s_psat). Pods pull identity over the Workload API, so nothing sits on disk, and mutual TLS between services follows automatically.
• Built a toolkit mapping cloud-native identity capabilities to NIST SP 800-53 controls, aligned to SP 800-207, CISA's Zero Trust Maturity Model, and OMB M-22-09. The point was evidencing federal RMF/ATO compliance without static secrets.
• Most of the work was edge cases: DNS and OIDC resolution inside a Private-Only VPC, default StorageClass and PVC binding, and CSI timeouts when choosing between IRSA and EKS Pod Identity. Documented the production hardening path with FIPS 140-validated crypto, an HSM/KMS-backed upstream CA, and an external HA datastore.

A photography platform and automated gallery-delivery system that replaced a stack of SaaS subscriptions and the habit of handing clients photos on a USB stick.

• A headless Raspberry Pi appliance (systemd daemon) watches for an inserted USB drive, compresses 7 GB+ galleries, and uploads them to S3. It reads progress aloud through AWS Polly, falls back to espeak when offline, and dumps logs back onto the stick if anything fails. There’s also a Python/CustomTkinter desktop uploader that shells out to multithreaded 7-Zip.
• S3 uploads trigger a container-image Lambda, built and shipped to ECR by a one-click script, that unzips the payload, generates Pillow thumbnails, and builds a lazy-loading gallery page.
• Per-gallery access keys are stored only as SHA-256 hashes. CloudFront signed cookies gate access at the edge, DynamoDB tracks the gallery mappings, and archived uploads expire after 30 days on a lifecycle policy. Pen testing confirmed every client gallery is isolated from the others.

Every resource here is declared in Terraform and every push to main deploys itself.

• Private S3 origin behind CloudFront with Origin Access Control. No public bucket, HTTPS end to end on an ACM certificate, DNS managed in Route 53.
• Bucket policies, the distribution, certificate validation, and DNS records all live in modular Terraform. The environment comes back from a single terraform apply.
• A GitLab pipeline plans infrastructure changes, gates the apply behind manual approval, syncs frontend assets to S3, and invalidates the CloudFront cache on every push to main.
• A missing path behind Origin Access Control comes back as 403 rather than 404, because the bucket policy grants GetObject only. Both are mapped to a real 404 page with a real 404 status. Serving the homepage with a 200 instead made every mistyped URL a soft 404 and invited Google to index it as duplicate content.