Sam Howard

A SPIFFE/SPIRE zero-trust control plane on Amazon EKS, built to emulate a restricted U.S. Army "Private Only" cloud — replacing long-lived static credentials with short-lived, auto-rotating identity.

• Architecture & deployment: Deployed a SPIFFE/SPIRE workload-identity control plane on EKS, issuing short-lived, auto-rotating X.509 SVIDs (~4-hour TTL) in place of static secrets.
• Continuous attestation & mTLS: Two-tier attestation pipeline — EC2 node attestation, then workload attestation via Kubernetes projected service-account tokens (k8s_psat) — so every pod pulls identity over the Workload API with no secrets on disk, enabling automatic mutual TLS between services.
• RMF compliance translation toolkit: Built a framework mapping cloud-native identity capabilities directly to NIST SP 800-53 controls, aligned with NIST SP 800-207, CISA's Zero Trust Maturity Model, and OMB M-22-09 — evidencing federal RMF/ATO compliance without static secrets.
• Troubleshooting & hardening: Resolved Private-Only VPC DNS/OIDC resolution, StorageClass/PVC binding, and IRSA-vs-EKS Pod Identity CSI timeout edge cases; defined the production hardening path with FIPS 140-validated crypto, an HSM/KMS-backed upstream CA, and an external HA datastore.

A custom photography platform and automated gallery-delivery system that replaced costly SaaS subscriptions and insecure USB handoffs — from a headless Raspberry Pi at the edge to a fully serverless AWS backend.

• Headless edge ingestion: A Raspberry Pi gateway auto-detects an inserted USB drive, extracts the photo archive, and uploads it to a dedicated S3 bucket — with AWS Polly speaking real-time progress updates through an attached speaker.
• Event-driven processing: S3 triggers Lambda, which captures the object URI and launches an ECS container that unzips the images, dynamically builds the client's gallery page, and provisions Lambda-generated cryptographic URL + passkey pairs for secure per-client access.
• Storage, tracking & hardening: Passkeys and gallery mappings tracked in DynamoDB; galleries transition to Glacier after 30 days via lifecycle policies; served over HTTPS through CloudFront with Route 53 DNS — with penetration testing verifying full isolation of every client gallery.

The site itself is a working case study: a fully serverless, infrastructure-as-code deployment where every resource is declared in Terraform and every commit ships itself to production through a GitLab pipeline.

• Secure static architecture: A private S3 origin fronted by CloudFront with Origin Access Control — no public bucket, HTTPS enforced end to end via an ACM certificate, DNS managed in Route 53.
• Infrastructure as code: The entire stack — bucket policies, distribution, certificate validation, DNS records, and the serverless backend — is declared in modular Terraform, so the environment is reproducible from a single terraform apply.
• CI/CD pipeline: A GitLab pipeline plans and applies infrastructure changes, syncs frontend assets to S3, and invalidates the CloudFront cache on every push to main — no console clicks in the deploy path.
• Serverless contact backend: The contact form below posts to an API Gateway endpoint that triggers a Python Lambda — validating input, storing inquiries in DynamoDB, and alerting me in real time. No servers, near-zero idle cost.