Cloud Security and Infrastructure Writing
Technical guides, implementation checklists, and dated field notes by Tymur Chmeruk. Start with a topic, follow the source references, or get new articles in a feed reader.
Subscribe to the RSS feedObservability and monitoring costs
Datadog cost analysis, log ingestion, and migration planning for Zabbix and Grafana.
-
How to Diagnose Zabbix SNMP Polling Delays Without Adding More Pollers
A Zabbix 7.4 troubleshooting workflow for SNMP queue delays, asynchronous poller saturation, device timeouts, preprocessing, and safe capacity changes.
-
Datadog Bill Too High? A Usage Audit Checklist
Audit logs, custom metrics, containers and traces with a usage worksheet. Find Datadog cost drivers and test one reduction before deciding whether to migrate.
-
Datadog Cost Reduction with Zabbix and Grafana: An Offload Plan
Plan what stays in Datadog and what moves to Zabbix, Grafana or a telemetry backend. Compare operational ownership, alert coverage and rollback before offloading.
-
Datadog to Grafana Migration: Practical Path for Infrastructure Dashboards
A practical guide to moving infrastructure dashboards from Datadog to Grafana-backed data sources while keeping high-value application observability in Datadog.
-
Datadog to Zabbix Migration: What Should Move and What Should Stay
A phased migration guide for offloading static infrastructure, network devices, and basic availability checks from Datadog to Zabbix without breaking alert coverage.
-
How to Reduce Datadog Log Ingestion Cost Without Losing Visibility
A practical log reduction strategy for classifying high-value logs, sampling noisy streams, filtering at the edge, and routing lower-value telemetry to cheaper storage.
-
Zabbix vs Datadog Cost: When Zabbix Still Makes Sense
A workload-based comparison of Zabbix and Datadog cost models, showing where Zabbix fits, where Datadog still earns its cost, and how to split monitoring responsibilities.
Cloud security and evidence
AWS CloudTrail coverage, FedRAMP evidence, and NIST control implementation.
-
How to Validate AWS CloudTrail Coverage Across a Multi-Account Organization
A practical method for validating CloudTrail coverage across AWS Organizations, Regions, event selectors, delivery health, and log integrity.
-
FedRAMP 20x Evidence in AWS: From Snapshots to Persistent KSI Validation
How to design AWS evidence for FedRAMP 20x around persistent KSI verification, validation, configuration history, metrics over time, and reproducible collection.
-
Hardening Hybrid Cloud: NIST 800-53 in Practice
A deep dive into implementing the Risk Management Framework (RMF) for AWS and On-Premise environments.
Infrastructure field notes
Dated engineering notes with source links and operational context.
-
How to Build an OpenTelemetry Gateway That Controls Cardinality Before Backend Ingestion
A practical OpenTelemetry Collector gateway design for controlling metric cardinality, filtering low-value telemetry, and protecting backend ingestion.
-
How to Turn Terraform Drift Detection Into Audit-Ready AWS Evidence
A practical pipeline for detecting Terraform drift in AWS, attributing changes, normalizing evidence, validating coverage, and retaining history.
-
Intel: Geopolitical Outages, AI Capacity Squeezes, and Sovereign Edge AI
Technical intelligence analysis on physical cloud infrastructure loss in AWS Middle East regions, rising compute costs across latency-sensitive workloads, and European sovereign boundaries for enterprise desktop assistants.
-
Intel: AWS AI Price Hikes and GitHub's Compute Capitulation
GitHub's AI-driven capacity failures force an Azure-to-AWS failover precisely as Amazon spikes AI compute costs by 20%. Architectural fallout and cost-containment.
-
Intel: AWS AI Compute Hyperinflation and the EU Sovereign Fracture
AWS slaps another 20% tax on AI workloads while the EU aggressively decouples from US infrastructure. Your globalized architecture is a massive liability.
-
Intel: Sovereign Tech Stacks and the 'Vibe Coding' Threat Vector
Architectural countermeasures for Microsoft antitrust risk, EU data localization, and the explosion of AI-generated shadow IT.
-
Intel: Kinetic Infrastructure Loss and Generative Shadow IT
Architectural fallout from AWS datacenter drone strikes, Bedrock Grok integration, and mitigating the sprawl of AI-generated shadow databases.
-
Intel: Kinetic Strikes, Project Titus, and AWS IAM Rot
Architectural response to physical drone strikes on AWS infrastructure, high-density AI power constraints, and critical IAM drift remediation.
-
Intel: Quantum Decryption Timelines, Kinetic Targets, and Modular Scaling
Assessing the blast radius of Q-Day, Oracle's UAE kinetic exposure, and AWS Project Houdini's modular IaC physical layer.
-
Intel: Inference Silicon Shifts, IAM Negligence, and the Q-Day Horizon
Assessing Arm's direct-to-datacenter AGI CPU, the catastrophic $25M AWS key compromise at Resolv Labs, and mandatory architectural pivots for Post-Quantum Cryptography.
-
Intel: Custom Silicon, Leaked Keys, and Kinetic Cloud Threats
Arm drops IP licensing for direct silicon at Meta. Resolv Labs bleeds $25M to an AWS IAM failure. Oracle UAE takes a geopolitical hit.
FedRAMP implementation guides
Published guides with links to their source references.
Downloadable evidence kits
Companion workbooks and synthetic examples for planning infrastructure evidence.