Jigar Shah

A consistent plane across teams at Pinterest to achieve deploy orchestration using EC2 APIs underneath.

Easy to store keys and values in terms of objects. Easy to classify data between personally identifiable vs non critical. Easy to add access controls through s3 bucket policies and IAM policies.

Security team builds services, solutions and tools for teams within Pinterest to manage accesses of critical production resources as well as facilitate adding authentication, authorization and accounting within critical production micro-services. Issuing identities to > 130k AWS EC2 instances, using them to make authentication and authorization decisions high bandwidth critical traffic flow conditions while services communicate in a mesh, requires a great deal of performance and stability. GoLang provides exactly that. Also primary engineering skills in Security team need not to be fully familiar with complex programming logic requires in Java/Kotlin while avoiding the pitfalls on runtime failures or uncertain behavior using Python in production leads us to GoLang

We would like to detect unusual config changes that can potentially cause production outage.

Such as, SecurityGroup new allow/deny rule, AuthZ policy change, Secret key/certificate rotation, IP subnet add/drop. The problem is the source of all of these activities is different, i.e., AWS IAM, Amazon EC2, internal prod services, envoy sidecar, etc.

Which of the technology would be best suitable to detect only IMP events (not all activity) from various sources all workload running on AWS and also Splunk Cloud?