AWS User Group Poland Kraków

🗓 Save the Date
🍔 + 🍺 = Let's gather around appetizers and beverages at Remitly
or
Watch the stream on YouTube (link)
Hosted by:
Maciej Lelusz, AWS Hero
AWS Community Builders: Maria Kmita & Paweł Kusiński

🎤 Speakers:
〰️ Marek Szlagor, Staff Infrastructure Engineer at Remitly
From 1 to N: Splitting a Monolith EKS Cluster Without Breaking Production
〰️ Pawel Zapior, Security Engineer at Remitly
Beyond Static Linting: Context-Aware IAM Change Evaluation in AWS

💡 Details about Speakers & Talks💡
Marek Szlagor: Staff Infrastructure Engineer at Remitly whose 13+ year path ran from embedded software through security to cloud infrastructure, now scaling Kubernetes on AWS.

☞ will speak about:
For years, almost everything at Remitly ran on a small set of large Kubernetes clusters. It was simple until it wasn't. Every upgrade became a high-stakes event, one noisy workload could hurt everyone else, and a single bad change could take down the whole platform. For a company moving money around the world 24/7, that wasn't acceptable.

This talk covers how we moved to many clusters on AWS, focusing on what got harder once services no longer shared a cluster: service discovery and security. We'll show how services find and trust each other across EKS clusters, how we enforce least privilege in a highly regulated financial environment, and the lessons we learned the hard way.

Pawel Zapior: Security Engineer at Remitly whose path ran from penetration testing to cloud security, now securing AWS environments at scale. Paweł builds guardrails and automation, convinced that effective security doesn't have to come at the cost of development speed. When he's not securing the cloud, he immerses himself in the world of railways.

☞ will speak about:
Predicting the cloud security blast radius of an infrastructure change using static code analysis is a notorious blind spot. While standard IaC dry-runs show what changes will be made to the resources, they remain context-blind to how those modifications interact with the broader environment. In an IAM context, a single change to the trust policy of an IAM role can implicitly trigger a 4-hop privilege escalation chain across hundreds of AWS accounts, completely invisible to standard static checks.

During this session, we will present a solution that addresses this risk by dynamically evaluating the impact of IAM role configuration changes: a context-aware linter driven by an enterprise-wide identity graph. Ultimately, we would also like this presentation to serve as an inspiration for tackling a similar class of problems: changes that look harmless in isolation but become risky in the context of large, highly regulated and dynamic environments.