tpschmidt

Keybase proof

I hereby claim:

• I am tpschmidt on github.
• I am tpschmidt (https://keybase.io/tpschmidt) on keybase.
• I have a public key ASAgvPAm-OIZkHW9Ydkwa3IOb8uPqqg8TmN-OYF5Dbb-ZAo

To claim this, I am signing this object:

tpschmidt

import AWS, { StepFunctions } from 'aws-sdk'
import { v4 } from 'uuid'
import { StartExecutionInput, StartExecutionOutput } from 'aws-sdk/clients/stepfunctions'

interface StateMachineSubmission {
  customerId: string
  traceId: string
}

export class StateMachineService {

tpschmidt

Hi 👋 My name is Tobi

Cloud Specialist & Software Engineer

• 🌍  I'm based in Germany
• 🖥️  See my portfolio at tpschmidt.com
• ✉️  You can contact me at contact@tpschmidt.com
• 🚀  I'm currently working on Weddingtastic

tpschmidt

#!/bin/bash

retention_days=$1

if [ -z "$retention_days" ]; then
  echo "Usage: $0 <retention_days>"
  exit 1
fi

regions=$(aws ec2 describe-regions \

tpschmidt

#!/bin/bash
set -eu

# ── SSM agent ────────────────────────────────────────────────────────────────
# We need the SSM agent for accessing Lightsail instances
if ! snap services amazon-ssm-agent | grep -q 'active'; then
  snap stop amazon-ssm-agent || true
fi
/snap/amazon-ssm-agent/current/amazon-ssm-agent -register -y \
  -id "${ssm_activation_id}" \

tpschmidt

Hardened AWS Org — Terraform

The important pieces from my weekend hardening pass. All values anonymized (account IDs, emails, usernames). Code is straight from the live setup, just stripped of identifiers.

Files

1. 01-scps.tf — DenyServices (13 statements) + EnforceMFA. Region pin, instance-class allowlist, audit-tamper denies,

tpschmidt

// Weekly AWS cost report -> Slack
//
// Lambda (nodejs18.x) triggered by EventBridge every Friday 08:00 UTC:
//   cron(0 8 ? * FRI *)
//
// Pulls month-to-date usage, credits (MTD + YTD) and an end-of-month
// forecast from Cost Explorer, then posts a Block Kit summary to Slack.
// Slack webhook URL is read from SSM Parameter Store (SecureString).
//
// Env: