I’m mapping my 2025 study plan and want courses that go beyond basics into designing defensible multi-account landing zones, identity guardrails, and policy-as-code (OPA/Azure Policy). If you’ve done AWS Security Specialty, CCSP, or SANS SEC540 recently, what moved the needle for secure-by-default architecture and IaC-driven controls?
Start ‘policy-as-code’ with Conftest+OPA in CI; enforce multi-account via https://cloudcustodian.io. SEC540 labs made this click; using AFT yet?
Building on @tpeterson71, the biggest needle-mover was codifying ‘deny-by-default at the org root’ — templatized SCPs + Control Tower proactive controls in CI with cfn-guard (GitHub - aws-cloudformation/cloudformation-guard: Guard offers a policy-as-code domain-specific language (DSL) to write rules and validate JSON- and YAML-formatted data such as CloudFormation Templates, K8s configurations, and Terraform JSON plans/configurations against those rules. Take this survey to provide feedback about cfn-guard: https://amazonmr.au1.qualtrics.com/jfe/form/SV_bpyzpfoYGGuuUl0) to block noncompliant IaC before merge; it’s child locks for every account. Have you tried IAM Identity Center permission sets with ABAC tags for multi-account least privilege, or are you still on role-by-role RBAC?