Mark Watson

[Mark Watson @finopsguru]

New post: EKS Cluster Autoscaler scales on resource *requests*, not actual usage — so over-provisioned pods look busy even when idle.

Covers CA's blind spots and why Karpenter's consolidation approach changes the math:
https://t.co/re1xgUe77N

#AWS #EKS

[Mark Watson @finopsguru]

Karpenter vs Cluster Autoscaler: CA scales node groups. Karpenter provisions the exact instance type each pod needs, then consolidates continuously.

The cost gap for variable workloads is typically 30-60%.

Worth evaluating if you run mixed EKS workloads. #AWS #Kubernetes

[Mark Watson @finopsguru]

S3 Intelligent-Tiering automatically moves objects between access tiers based on usage patterns.

No retrieval fees for objects under 128KB. No operational overhead.

If you have buckets with unpredictable access patterns, it's worth enabling — AWS handles the rest.

#AWS #FinOps

[Mark Watson @finopsguru]

gp2 EBS volumes: $0.10/GB-month.
gp3 EBS volumes: $0.08/GB-month — 20% cheaper with better baseline performance.

Migration is zero-downtime. Modify the volume type while it's attached.

If you haven't audited EBS types since 2020, you're overpaying.

#AWS #FinOps

[Mark Watson @finopsguru]

New post: how attackers chain sts:AssumeRole calls to reach your org management account from a compromised dev role — and what to look for in CloudTrail.

https://t.co/jyFXfnqX4J

#AWS #CloudSecurity

[Mark Watson @finopsguru]

Attackers don't need your root keys.

Compromise any role with sts:AssumeRole permissions → pivot to higher-privilege roles across accounts → silently.

CloudTrail captures every AssumeRole call. Most teams have no alert on it.

That's the gap. #AWS #CloudSecurity

[Mark Watson @finopsguru]

NAT Gateway: the AWS service most teams forget to optimize.

Every GB in and out gets charged. Running containers? Pulling from ECR? It adds up fast.

Quick audit: check your Cost Explorer for NatGateway line items this month.

#AWS #FinOps

[Mark Watson @finopsguru]

Most AWS teams don't know NAT Gateway charges per GB processed.

EC2 pulling Docker images from ECR through NAT? $0.045/GB you didn't plan for.

Fix:
• S3 Gateway Endpoint → free
• ECR VPC Endpoint → $0.01/GB

Simple swap, real savings. #AWS #FinOps

[Mark Watson @finopsguru]

AWS credentials leaked to GitHub get scraped in ~4 minutes.

Attacker's first move: spin up miners in us-east-1, eu-west-1, and ap-southeast-1 simultaneously.

Native AWS alerting fires the next morning.

By then: 18 hours of c5.18xlarge. Your problem.

#AWS #CloudSecurity

[Mark Watson @finopsguru]

Going to share real incident breakdowns, CloudTrail forensics, and FinOps war stories.

Follow if you run AWS at any scale.

[Mark Watson @finopsguru]

Starting this account to talk about AWS cost disasters, security incidents, and how to stop both before they hit your bill.

Built https://t.co/sp7K9BQgQu — real-time AWS threat + cost detection.