The Substrate Blog

Sign in Subscribe

Better Access Control in AWS

The benefits and drawbacks of standing versus just-in-time access control. In a maturing startup, compliance programs like SOC 2 will require the engineering team to take a hard look at who can access what parts of the production systems. You’ll need to consider the risk and reward of having

One giant AWS account is technical debt you can’t afford

Picture yourself at an AWS-using startup. It’s a year or two old and maybe starting to see product-market fit. As the CTO or one of the first engineers, you’ve made but a fraction of the architectural and technical decisions that will be made over the course of the

Who should be on-call for incident response

Paging the right engineers for faster time to resolution, lower error rates, and a culture of ownership and collaboration. If a software engineer pushes code to production, writes code for a production application, or makes changes to production systems, they should be on-call. If the system breaks, has a high

SOC 2 compliance for startups and first-timers (part 4)

How to operate and improve your compliance program after a first SOC 2 audit If you’re reading this while your customers are reviewing that first SOC 2 report, then congratulations. You’re now getting maximum credit for good security practices! Celebrate quickly, though, because the work continues. Especially if

SOC 2 compliance for startups and first-timers (part 3)

What to know going into your first SOC 2 audit Once you’ve defined controls that meet the SOC 2 criteria, it’s time for your first SOC 2 audit. (See part two of this series if you still need to define your controls.) During your audit, you’ll prove

Cloud cost allocation made easy

Skip tedious tagging in favor of this simple but robust AWS account strategy that makes neat, shareable reports quickly. Imagine you’re on the path to maturing your startup, and the finance team needs you to build reliable and correct cost attribution. You know, things like cost of goods sold

SOC 2 compliance for startups and first-timers (part 2)

Reading the criteria, writing controls, and preparing for your first SOC 2 audit No matter how deftly a startup delays SOC 2 compliance (as discussed in part one of this series), they will eventually need to tackle it. When you’ve filled out enough infosec questionnaires to last a lifetime,

SOC 2 compliance for startups and first-timers (part 1)

How to delay an audit without sabotaging your business Many of the companies that reach out to Substrate are motivated by how much it can help them meet the SOC 2 criteria concerning access control and change management. Doing AWS right with Substrate will absolutely help you meet those criteria,

The front of a Rivian R1T with a light dusting of snow.

Safe and reliable production changes for fast moving teams; and how Rivian recently got this wrong

Changing production infrastructure can be scary because we don’t want to break things for customers, mistakes happen, and there can be many unknowns. In this post I’ll be discussing a recent over-the-air (OTA) software update to Rivian vehicles that went badly. It is speculative; I have no insider

Substrate Newsletter Vol 1

Welcome to the first Substrate newsletter, where we highlight some of the best new capabilities added in the past few months and provide a preview of what’s coming next. To take advantage of all the new features, we recommend upgrading Substrate to the latest version and then doing so

Terraform best practices for reliability at any scale

State file proliferation for fun and profit When first adopting Terraform there’s a natural attraction to having a single state file that covers your entire infrastructure. It’s simple. It’s expressive. It’s fast—at first. And it’s a terrible idea. At scale, many Terraform state files

An AWS account just for getting into other AWS accounts

In You should have lots of AWS accounts, I made a case for isolating environments and even services in their own accounts to reap all sorts of security, reliability, and compliance benefits. With the right tools in hand (Substrate, for one), operating lots of accounts can be just as efficient

You should have lots of AWS accounts

I know. You need another AWS best practice like you need another covid exposure. But you really should have lots of AWS accounts. Lots of AWS accounts working together in harmony will net you a more secure, more reliable, and more compliant cloud infrastructure. All of the reasons to have