"Encrypted at rest" means little if the key sits next to the data
How envelope encryption with cloud KMS really protects your data, what key rotation does and doesn't do, and how AWS, Google Cloud and Azure differ.
Ravindra KumarA FIELD GUIDE TO BUILDING IN THE CLOUD
Less noise.
More know-how.
Practical guides, lessons learned, and useful resources for your cloud-native journey.
Notes from Ravindra KumarTHE LATEST FIELD NOTE
Cloud Security"Encrypted at rest" means little if the key sits next to the data
How envelope encryption with cloud KMS really protects your data, what key rotation does and doesn't do, and how AWS, Google Cloud and Azure differ.
Ravindra Kumar11 Nov 2026 · 3 min read
FROM THE NOTEBOOK
Worth your next read.
Ravindra Kumar
I pentested my own AI-agent guardrails. One character got a DELETE through.
An open-source policy library for MCP tool calls passed its own unit tests, then failed a real attack. What the bug was, why guards and databases disagree, and how to try the fix.
Ravindra Kumar
From the internet to an EKS pod: every checkpoint on the way
Follow one HTTPS request through an Internet Gateway, NACLs, security groups, an ALB, Istio and a NetworkPolicy, and see where each kind of bad traffic gets stopped.
Ravindra Kumar
Connecting AWS and Google Cloud for a large enterprise: the network design that holds up
A reference architecture for joining AWS and Google Cloud privately: IP planning, the three interconnect options, hub-and-spoke on both sides, hybrid DNS and security, with editable draw.io diagrams.
Ravindra KumarSMALL STEPS. REAL PROGRESS.