Sam Howard

A SPIFFE/SPIRE zero-trust control plane on Amazon EKS, built to emulate a restricted U.S. Army "Private Only" cloud, replacing long-lived static credentials with short-lived, auto-rotating identity.

• Architecture & deployment: Deployed a SPIFFE/SPIRE workload-identity control plane on EKS, issuing short-lived, auto-rotating X.509 SVIDs (~4-hour TTL) in place of static secrets.
• Continuous attestation & mTLS: Two-tier attestation pipeline, EC2 node attestation, then workload attestation via Kubernetes projected service-account tokens (k8s_psat), so every pod pulls identity over the Workload API with no secrets on disk, enabling automatic mutual TLS between services.
• RMF compliance translation toolkit: Built a framework mapping cloud-native identity capabilities directly to NIST SP 800-53 controls, aligned with NIST SP 800-207, CISA's Zero Trust Maturity Model, and OMB M-22-09, evidencing federal RMF/ATO compliance without static secrets.
• Troubleshooting & hardening: Resolved Private-Only VPC DNS/OIDC resolution, StorageClass/PVC binding, and IRSA-vs-EKS Pod Identity CSI timeout edge cases; defined the production hardening path with FIPS 140-validated crypto, an HSM/KMS-backed upstream CA, and an external HA datastore.

A custom photography platform and automated gallery-delivery system that replaced costly SaaS subscriptions and insecure USB handoffs, from a headless Raspberry Pi at the edge to a fully serverless AWS backend.

• Headless edge ingestion: A Raspberry Pi appliance (systemd daemon) auto-detects an inserted USB drive, compresses and uploads 7 GB+ galleries to S3, and speaks real-time progress via AWS Polly neural voice, with an offline espeak fallback and automatic log dumps to the USB stick on failure. Paired with a Python/CustomTkinter desktop uploader that shells out to multithreaded 7-Zip for maximum throughput.
• Event-driven processing: S3 triggers a container-image Lambda (built and shipped to ECR via a one-click deploy script) that unzips the payload, generates Pillow thumbnails, and builds a lazy-loading gallery page, with per-gallery access keys stored only as SHA-256 hashes and access gated by CloudFront signed cookies at the edge.
• Storage, tracking & hardening: Access-key hashes and gallery mappings tracked in DynamoDB; archived uploads auto-expire after 30 days via S3 lifecycle policies; served over HTTPS through CloudFront with Route 53 DNS, with penetration testing verifying full isolation of every client gallery.

The site itself is a working case study: a fully serverless, infrastructure-as-code deployment where every resource is declared in Terraform and every commit ships itself to production through a GitLab pipeline.

• Secure static architecture: A private S3 origin fronted by CloudFront with Origin Access Control, no public bucket, HTTPS enforced end to end via an ACM certificate, DNS managed in Route 53.
• Infrastructure as code: The entire stack, bucket policies, distribution, certificate validation, DNS records, and the serverless backend, is declared in modular Terraform, so the environment is reproducible from a single terraform apply.
• CI/CD pipeline: A GitLab pipeline plans and applies infrastructure changes, syncs frontend assets to S3, and invalidates the CloudFront cache on every push to main, no console clicks in the deploy path.
• Serverless contact backend: The contact form below posts to an API Gateway endpoint that triggers a Python Lambda, validating input, storing inquiries in DynamoDB, and alerting me in real time. No servers, near-zero idle cost.