Jacob Marks

 AWS announced support for Cartes Bancaires in AWS Payment Cryptography. You can read the official announcement here: https://aws.amazon.com/about-aws/whats-new/2026/02/payment-cryptography-cartes-bancaires/ I was not there for the final announcement, but I was heavily involved in the work that made it possible. A large part of that work was audit readiness and making sure the implementation would satisfy the requirements for approval. Cartes Bancaires was still developing their audit program while we were going through the process, which added complexity. I worked directly with Deloitte through the review and was on every vendor call covering progress, evidence, gaps, and what was needed to get across the finish line. Most of the work is not visible from the outside. It was documentation, evidence, validation, follow-up, and making sure assertions matched what could actually be defended during audit. That work is rarely visible, but it is what makes launch possible.

Note: I originally sketched this post years ago and never finished it. I’m publishing it now as a retrospective on how I think about VPC Flow Logs at scale. VPC Flow Logs: Use Them Intentionally For a long time, the default guidance in AWS environments was simple: enable VPC Flow Logs everywhere. At small to moderate scale, that advice is usually fine. At large scale, it becomes expensive, noisy, and often redundant. There’s an inherent catch-22 with Flow Logs. If you don’t have them enabled, you miss historical data when you need it. If you enable them universally, you can generate massive volumes of duplicated traffic data that few teams ever analyze in a meaningful way. At sufficient scale, AWS can perform network-level analysis across its infrastructure independent of whether an individual account is exporting Flow Logs. Because of that, Flow Logs are not always treated internally as a hard security requirement for every workload. I argued for that shift myself, main...

Note: I originally wrote this post in 2017 but never published it at the time. Please note that the AWS certification landscape has changed significantly since then; this is provided strictly as a historical reference. Another year another re:Invent. This year at re:Invent 2017, because my associate was up for renewal again, I decided to sit for the AWS Solutions Architect Professional Exam. The exam is in beta phase where questions are being tested, refined and the exam pass line is being set. I won't find out if I passed until March 2017 and I can't share actual exam questions but I can share advice for others that are interested in the exam in the future. Note that as of Jan 2017 the beta is currently closed as it's proved to be very popular. Preparation: I entered the exam cold, drawing only on my working knowledge of AWS and its services so my perspective should be an unbiased view of the exam. There is an exam blueprint but it's been pulled from the AWS...

AWS announced AWS Payment Cryptography is now available in the Asia Pacific (Sydney) Region. You can read the official announcement here: https://aws.amazon.com/about-aws/whats-new/2025/12/aws-payment-cryptography-in-sydney/ This was a particularly difficult launch. Not because of one major issue, but because there were a lot of moving pieces all happening at once. Hardware deployment issues, firmware rollout problems, feature dependencies colliding near the finish line, compliance requirements, launch timing, and the normal reality that things rarely line up as cleanly in practice as they do on a plan. A lot of the work near launch was simply making sure everything that needed to happen actually happened, in the right order, without creating new problems somewhere else. Regional expansion for a service like this is never just turning something on in another place. Every assumption around hardware, operations, and readiness gets tested again. Those are usually the hardest launches. Not...

AWS announced Multi-Region Keys in AWS Payment Cryptography. You can read the official post here: https://aws.amazon.com/blogs/security/multi-region-keys-a-new-approach-to-key-replication-in-aws-payment-cryptography/ This was a meaningful launch because it crossed one of the boundaries AWS takes very seriously: Region isolation. Replicating payment cryptographic keys across Regions meant moving highly sensitive customer material across a boundary that is normally treated as a hard line. That required a lot of design review, security scrutiny, and approvals. Moving critical customer data across Regions is not something anyone treats casually. One of my engineers handled much of the implementation while I drove execution, launch readiness, and stakeholder alignment. Because the launch was time-sensitive, I had to stay deeply involved in approvals, resolving concerns, and making sure decisions were happening fast enough to keep the work moving. A lot of the real work was not writing c...

AWS announced the launch of AWS Payment Cryptography this week, and I’ve had the opportunity to lead the service from its earliest definition through production launch. The official AWS announcement is here: https://aws.amazon.com/about-aws/whats-new/2023/06/aws-payment-cryptography/ . This was one of those projects where the hard part was never just building software. The challenge was defining a service that could meet the expectations of payment processors, issuers, and financial institutions who were used to a vastly different interaction model while operating inside the security, compliance, and operational standards required for payment cryptography. My role started at the beginning: taking early customer input, writing the initial business requirements, and helping shape the architecture that would eventually become the service. That meant defining the threat model, establishing the security posture, and making early decisions around control-plane boundaries, data-plane design, ...

The cloud market continues to get more competitive. AWS built its early success by winning developers first. Startups and builders were willing to take risks, move fast, and trust new platforms if those platforms made their jobs easier. AWS became the default choice because it gave developers access to infrastructure and services that previously required enormous capital, time, and operational overhead. That advantage should not be taken for granted. As the market matures, competitors are closing the gap. Microsoft in particular understands something important: developers and operations professionals are often the real catalyst for cloud adoption inside an enterprise. CIOs, CTOs, and procurement teams may approve the decision, but developers and operators heavily influence which technologies ever make it that far. If AWS wants to maintain its leadership position, we cannot rely only on top-down executive relationships. We must continue to win the people who actually build and operate s...

*** NOTE: AWS has pulled this specific certification version, refunding those who took the original beta exam. *** 2026 Status Update: The AWS Certified Security - Specialty is now a mature, standard certification. While the beta period mentioned below ended years ago, the core focus on deep-dive security across IAM, Encryption, and Incident Response remains the primary objective of the current exam version. I had the opportunity to take the AWS Certified Security Specialty Exam at re:Invent 2016. The exam was in a beta phase where questions were being tested, refined, and the exam pass line was being set. While I can't share actual exam questions, I can share advice for others interested in the certification path. Preparation I entered the exam cold, drawing only on my working knowledge of AWS and its services, so my perspective is an unbiased view of the exam's difficulty. While blueprints change, the foundational security pillars remain consistent. Format ...

Implementing the Amazon Cognito User Pool Admin Authentication Flow with AWS SDK For .NET offers a path to implement user authentication without management of a host components otherwise needed to signup, verify, store and authenticate a user. Though Cognito is largely framed as a mobile service, it is well suited to support web applications. In order to implement this process you would use the Admin Auth Flow outlined in the AWS produced slide below. This example assumes that you have already configured both a Cognito User Pool w/ an App, ensuring the "Enable sign-in API for server-based authentication (ADMIN_NO_SRP_AUTH)" is checked for that app on the App tab and that no App client secret is defined for that App. App client secrets are not supported in the .NET SDK. It is also assumed that a Federated Identity Pool is configured to point to the before mentioned User Pool. This auth flow bypasses the use of Secure Remote Passwor...

Looking for a quick and easy way to query an Amazon Redshift Database Cluster? I was and the first place I turned was to my favorite tool for this kind of thing, Linqpad . I was a bit dismayed to find that none has developed, that I could find, a Linqpad database driver for Redshift. Small note, there are a few Postresql options and Redshift is supposed to be Postresql compatible however, none of them seemed to work for Redshift. Giving credit to the author of this article describing the use of Linqpad for connections to MS Access, I made a few tweaks and boom, I have a working way to connect to and query Redshift. So in the pay it forward spirit, I thought I'd share. 2026 Driver Update: AWS is retiring the legacy 1.x ODBC driver on June 1, 2026. Ensure you have installed the Amazon Redshift ODBC Driver 2.x . Unlike previous versions, the x64 driver is now the standard requirement for modern versions of LINQPad. // PREREQUISITES: // (1) Copy and paste this entire b...

CloudWatch includes a powerful feature that enables auto recovery of an EC2 instance if it ever fails a system status check. A key benefit of this feature is that it relaunches an instance with the exact same configuration, preserving any auto-assigned public IP addresses and using the current instance volumes. Modern Update (2026): Automatic recovery is now supported for most deployed Amazon EC2 instances. Most current-generation instances (Nitro-based) support Simplified Automatic Recovery , which can be configured directly from the EC2 Instance console without manually building a CloudWatch alarm from scratch. Every EC2 instance is monitored for two distinct types of status checks that report as metrics to CloudWatch: System status checks: These identify AWS infrastructure issues, such as hardware failures, network connectivity loss, or power outages in the data center. Instance status checks: These identify software or configuration issues, such as corrupted...

Automating EBS snapshots is a critical part of maintaining a resilient infrastructure. Below is a simple Python Lambda function that identifies all volumes attached to an EC2 instance and creates a snapshot for each. Modern Update (2026): While custom Lambda scripts like this one are great for specific logic, AWS now recommends using Amazon Data Lifecycle Manager (DLM) for standardized snapshot automation. It is policy-driven and doesn't require maintaining custom code. Lambda Function (Python) import boto3 import datetime def lambda_handler(event, context): ec2 = boto3.client('ec2') # Replace with your Instance ID or logic to fetch it instance_id = 'i-xxxxxxx' descriptions = ec2.describe_instances(InstanceIds=[instance_id]) for reservation in descriptions['Reservations']: for instance in reservation['Instances']: for block_device in instance['BlockDeviceMappings']: ...

*** UPDATE: This project was migrated from CodePlex to GitHub *** Obtaining Your Amazon SES SMTP Credentials can be more confusing than one would think. If you find yourself having difficulty authenticating to SES with the credentials that you got from the AWS Console, fret not, it's likely a simple fix. It is possible to create an IAM user both from the IAM and SES area of the Console. Depending on the path you take, your SES user's username and any manually generated password may not be used for SES authentication. Your SES Access Key is used as the username; however, the related Secret Key is not used as-is for this purpose. Required IAM Policy Be sure you have given your IAM user the necessary permissions to relay email through SES. Use the following "least-privilege" policy snippet: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ses:SendRa...

I've found myself wondering on more than one occasion if a network issue I'm having is a result of security configuration (Routing Rules, Network ACLs, Security Groups) or something else entirely. To solve this, I originally wrote a network modeling tool to trace traffic flow from a source to a destination, simulating security evaluation at each hop. Deprecation Notice (2026): This custom tool is no longer maintained and has been taken offline. AWS now offers native, high-fidelity services that provide this functionality with much greater accuracy: VPC Reachability Analyzer: Best for point-to-point troubleshooting. It shows hop-by-hop details and identifies the exact blocking component (e.g., a specific NACL rule). Network Access Analyzer: Best for security auditing. It helps you identify unintended network access and verify that your network segments are properly isolated. While my tool served its purpose during the early days of VPC man...

There are many posts with various accounts from the AWS CSA exam, so I will try to keep mine concise and to the point. The exam requires a foundational understanding of all AWS services. Questions are situational and focused on technical nuances. Rather than a test of deep systems architecture, it is largely a test of your familiarity with the AWS product ecosystem. Historical Perspective: This post reflects the original SAA-C00 exam version. I originally passed on March 11, 2014 , and completed the recertification on July 30, 2015 . While concepts like S3 and EC2 are evergreen, modern exams like SAA-C03 now prioritize serverless and managed services. My studies began with the sample exam questions provided by AWS. Since AWS does not provide the answers to those samples, I've documented my research and answers for them below. Sample Exam Question Deep Dive Amazon Glacier is designed for (Choose 2 answers) Answer(s): B - Infrequen...

I write about this topic because it's one that may not be immediately obvious to those new to AWS and with previous virtualization experience. In AWS, there is a much looser tie between various components that make up a server. An EC2 instance is essentially a reservation for processor power and memory. Persistent block storage (EBS) is associated with that instance through a device mapping. A snapshot is related to a volume , not the instance itself. If you want to "snapshot an instance," you are actually taking snapshots of each individual attached volume. Snapshots are incremental; they capture only the blocks that have changed since the last snapshot. Because you cannot technically "revert" a volume in place using traditional methods, you must create a new volume from the snapshot and swap it with the existing one. Modern Update (2026): AWS now supports a Replace Root Volume feature. You can now swap your root volume with a snapshot d...

With shrinking budgets many would wonder how the US Defense Department will maintain the infrastructure necessary to sustain the force. IT infrastructure supports everything from the acquisition, logistics and sustainable of something as simple as a bandage to something as complex as an aircraft carrier. It would simply not be possible to look away from the IT resources that have become a critical component of our ability to operate yet the cost of operations has never been higher. The DoD finds itself in a bit of a quandary and many organizations are rushing to consolidate data centers, reduce support or decommission older systems. So what, you might ask, are they to do to weather this storm? I personally believe that the commercial world has the solution, The Cloud, and you better believe that defense contractors are all scrambling to build a show of knowledge and flashy prototypes targeted at courting the fancy of those in the DoD already looking towards this path. One might sugge...