Infra Notes

Audit evidence becomes easier when logging, monitoring, backup, restore testing, and access control are part of the infrastructure design from the beginning.

A backup is only useful if the restore path has been tested, documented, and validated against the expected recovery scenario.

Access reviews become harder when IAM users, roles, groups, policies, and permission sets are named without a clear convention.

When service account key creation is blocked, the reason may be an organization policy even if project-level IAM looks correct.

Exclude noisy paths first before increasing file_limit on busy Linux servers or container hosts.

Before changing rule logic repeatedly, test custom rules with real log samples and confirm the matched decoder or base rule.

A quick checklist for debugging PodMonitor issues when the object exists but the target does not appear in Prometheus.

In GitOps-managed environments, rollback should start from Git history instead of manually patching Kubernetes resources.

Cloudflare proxied records can hide origin behavior, so origin testing should be done explicitly.

A WAF allowlist is safer when scoped to specific hostnames instead of the entire zone.

Use Ansible first_found to keep host-specific, environment-specific, and default config fallback clean.

Wrapper roles help keep upstream roles clean while adding your own deployment logic, files, and operational flow.

If repeated EICAR tests stop triggering, clamd cache may be hiding repeated detections.

Before changing exporters or scrape configs, confirm whether the issue is actually the Grafana query, variable, or label filter.

The best infrastructure work is often not flashy. It is predictable, documented, repeatable, and easy for the next person to operate.

A quick note for setting up an AWS SSO profile and logging in explicitly with the intended profile name.