This website: static hosting on AWS
The site you're on: infrastructure in Terraform, deploys from GitHub Actions without stored keys, and a private dev copy behind a login.
Notes on cloud architecture, from my own projects.
I'm Kerim, a Lead Cloud Engineer. I design and build cloud platforms. On this site I write about the things I build and what I learn from them.
- Certified
- AWS Solutions Architect – Associate
- Clouds
- AWS · Azure · Google Cloud
- Experience
- Cloud engineering since 2022
About
I work on the cloud platform of a large information services company: the shared foundation that the product teams build on.
Background
I studied electrical engineering and started out in hardware: low-power IoT devices, and electronics for a certified medical device. After a year in data analytics I moved into cloud engineering in 2022. I joined as an associate engineer and I’m now the lead.
Education: MSc Technology and Engineering Management, UPC BarcelonaTech (2021 – 2023), and BSc Electrical and Electronics Engineering, The Hague University of Applied Sciences (2016 – 2020).
Languages: Dutch (native), English (fluent), Turkish (conversational) and Spanish (B1–B2).
How I think about infrastructure
I try to keep infrastructure dull. It lives in code, changes go through review and a pipeline rolls them out, and it should be simple enough for the next person to pick up without having to ask me. Roles get the least access that works, and I’d rather use short-lived credentials than keys that sit around for years.
When I make a decision I write down why, because that’s the part people forget first. Writing things down is also most of the reason this site exists.
My full work history is on LinkedIn.
What I work on
Multi-account governance
How AWS accounts are organised, which guardrails apply to them, and how people sign in to them once there are too many to manage by hand.
Networking across clouds
Hub-and-spoke networks that connect AWS, Azure and on-premises sites, and the routing and segmentation between them.
Infrastructure as code and automation
Most of the infrastructure I work on is defined in Terraform or OpenTofu, from networks and compute to databases and identity. Changes go through a pull request, and a pipeline in GitHub Actions or Jenkins applies them. Repetitive operational work I automate with Python.
Migrations and cost
Moving workloads into the cloud or between clouds, and the cost that builds up when nobody owns it.
Skills
AWS
- Organizations
- IAM Identity Center
- Lambda
- ECS & Fargate
- Route 53
Networking
- Transit Gateway
- VPC & PrivateLink
- Direct Connect
- VPC Lattice
- IP address management
Multi-cloud
- Azure
- Google Cloud
- Entra ID federation
- Azure Virtual WAN
- Hybrid connectivity
Code & pipelines
- Terraform
- OpenTofu
- GitHub Actions
- Jenkins
- Python (boto3)
Security & governance
- Guardrails with SCPs
- Least-privilege access
- Tagging governance
- Compliance reporting
- Cloud Custodian
Operations & migrations
- Datadog
- CloudWatch
- Cost optimisation
- Cloud migrations
- Consolidation & decommissioning
Projects
Articles
All articles →How this website works
A private S3 bucket behind CloudFront, DNS in Cloudflare, Terraform for the infrastructure and keyless deploys from GitHub Actions: what I built, why, and what doesn't behave as you'd expect.
Contact
The quickest way to reach me is by email or on LinkedIn. Questions about an article, corrections and plain hellos are all welcome.