ReneeBuilds Platform
Each project solves a distinct layer of the identity security problem — from provisioning an identity on day one to auditing its policy posture years later.
Enterprise equivalent: Microsoft Entra ID · Okta · Any OIDC/SAML Identity Provider
Production-grade Keycloak 26.2.4 on RHEL 10 with PostgreSQL 16, TLS hardening, OIDC and SAML 2.0 client configuration, and Python-automated Joiner-Mover-Leaver lifecycle. Generates real audit events that feed the platform's shared data lake and GRC1 certification workflow downstream. Enhanced with Kubernetes Operator deployment, Prometheus/Grafana/Alertmanager observability stack (provisioned via Ansible), default-deny NetworkPolicy with negative testing, per-workload ServiceAccounts, and scoped Grafana DB role — each fix traced to a verified root cause including a silent RBAC denial that was invisible only because the deployment ran a single replica.
Enterprise equivalent: CyberArk EPV · BeyondTrust Password Safe
Production-grade PAM environment using HashiCorp Vault with KV secrets engine, AppRole authentication, Ansible-automated credential rotation, TLS-secured API endpoints, SHA-256 tamper-evident audit logs, and a Flask audit dashboard. Enhanced with Vault Agent Injector on Kubernetes — including root-cause investigation of a silent cert-injection failure masked by a permissive webhook failure policy and swallowed by the rotation script's own error handling, fixed durably via cert-manager with a root → CA → issuer chain and corroborated against a known upstream HashiCorp issue. RBAC and NetworkPolicy hardening caught two real gaps via testing, not review.
Enterprise equivalent: Splunk ES · Microsoft Sentinel · Okta ThreatInsight
Hybrid local-to-cloud SIEM pipeline ingesting Okta system logs via a cron-driven EC2 poller (every 5 min, DynamoDB cursor state) into Kinesis Firehose and an S3 data lake. Lambda triggers on EventBridge failed-login rules, generates AI risk narratives via Amazon Bedrock (Claude Sonnet 4.6), and routes alerts via SNS. Multi-region CloudTrail with ApiCallRateInsight captures AWS control plane activity. QuickSight SOC dashboard connected to Athena dataset. Three GitHub Actions workflows: push-triggered deploy, PR validation (fmt + validate + plan), and scheduled daily drift detection — all running on a self-hosted EC2 runner. Full Terraform infrastructure with remote state in S3.
Enterprise equivalent: Palo Alto Prisma Cloud CSPM · CrowdStrike Falcon CSPM · AWS IAM Access Analyzer
Audits AWS IAM policies for least-privilege violations via a 13-rule weighted engine — wildcard actions, missing MFA conditions, stale credentials, privilege escalation paths. Bedrock AI risk narratives per finding with Guardrails PII blocking. Async Flask job engine decouples scan execution from the browser. CRITICAL findings publish to the shared P3 SNS topic and S3 data lake. The ITDR Wave extended P4 into a detection-and-response layer: Azure RBAC detection (6 rules, fixture-modeled after confirming no live Azure tenant was reachable — a real infrastructure constraint, documented), JIT time-bound access remediation using the Azure PIM eligible/active state-migration model, Prometheus/Grafana/Alertmanager observability on k3s via Ansible, and shared Alertmanager routing with MIG. A real FP/FN test pass caught two live production bugs before they shipped — a wildcard-prefix check that missed realistic bucket patterns, and a malformed-date parse that silently dropped a credential-staleness check.
Enterprise equivalent: SailPoint IdentityNow · Saviynt · Any IGA Platform
AI-hardened MFA certification pipeline pulling live identity and MFA state from Keycloak 26, invoking Bedrock to render CERTIFY/REVOKE verdicts with mandatory PCI DSS Req 8.4.2 citations, writing tamper-evident audit evidence to SQLite, and firing SNS REVOKE alerts. Prompt injection protection and fail-secure REVOKE default on Bedrock error. Enhanced with full Kubernetes deployment, OIDC/Keycloak login gate, green Jenkins CI/CD, NetworkPolicy hardening, shared SNS/Alertmanager alerting path, and a duplicate-campaign race condition fixed using Kubernetes' own atomic name uniqueness guarantee.
Enterprise equivalent: Qualys Policy Compliance · AWS Security Hub · ServiceNow GRC
EventBridge → Lambda → Bedrock pipeline detecting AWS Config drift events in real time. XML-isolated prompt engineering blocks indirect injection from raw Config payloads. Concurrent Bedrock inference via ThreadPoolExecutor produces QSA-ready risk narratives with false-positive-free classification. CRITICAL findings publish to the shared SNS topic. Idempotent SQLite evidence store with INSERT OR REPLACE handles overlapping cron windows without duplicates. Flask reviewer dashboard with 30s auto-refresh and JSON API.
Enterprise equivalent: SailPoint · Saviynt · CrowdStrike Falcon Identity · Prisma Cloud CSPM
Reconciliation and entitlement engine pulling live state from Okta, AWS IAM, and GCP Cloud Asset Inventory concurrently on a 6-hour cadence — detecting orphaned accounts, inactive credentials, GCP service account key sprawl, identity map drift, and ungoverned service accounts across all three planes, then auto-remediating under a circuit breaker. The ITDR Wave extended this into a full detection-and-response layer: Prometheus/Grafana/Alertmanager/Pushgateway observability on k3s (provisioned via Ansible), shared Alertmanager routing with P4, and a cross-project Athena correlation dashboard joining MIG findings against P4 IAM findings. NHI governance caught the reconciliation engine's own GCP service account as ungoverned in its first live run. A meta-monitoring heartbeat detects pipeline failures invisible to the pipeline itself. Dead-letter alerting ensures SNS failures fail closed rather than crashing mid-run. GCP static hosting for this site is a direct byproduct — Terraform-managed, deployed via WIF-federated GitHub Actions with zero stored credentials. 10 ADRs document every major design decision.
Compliance Matrix
| Framework | P1 IAM | P2 PAM | P3 SIEM | P4 Audit | GRC1 | GRC2 | MIG |
|---|---|---|---|---|---|---|---|
| PCI DSS v4.0 | ✓ Req 7,8,10 | ✓ Req 7,8,10,12 | ✓ Req 10 | ✓ Req 7,8 | ✓ Req 7 | ✓ Req 10 | ◐ Req 8.3.4, 8.4.2 |
| NIST SP 800-53 r5 | ✓ AC-2, IA-2 | ✓ AC-6, IA-5 | ✓ AU-2, SI-12 | ✓ AC-6, AC-2 | ✓ AC-2 | ✓ CA-7 | ◐ AC-2(3), AC-6, IA-2(1) |
| NIST CSF | ✓ PR.AC | ✓ PR.AC, PR.IP | ✓ DE.CM | ✓ ID.AM | ✓ PR.AC | ✓ DE.CM | ◐ PR.AC, DE.CM, RS.RP |
| SOX ITGC | ✓ CC6.1, CC6.2 | ✓ S.404 | ✓ Continuous | ✓ Access ctrl | ✓ CC6.1 SoD | ✓ Oper. eff. | ◐ CC6.1, CC6.2 |
| ISO 27001:2022 | ✓ A.9, A.12 | ✓ A.8.2, A.8.24 | ✓ A.12, A.16 | ✓ A.9, A.18 | ✓ A.9 | ✓ A.18 | ◐ A.5.18, A.8.2 |
| HIPAA Security Rule | — | ✓ §164.308, §164.312 | — | — | ✓ §164.308(a)(3) | ✓ §164.308(a)(8) | ◐ §164.308(a)(3),(5) |
| CIS Benchmarks | ✓ RHEL 10 | — | — | — | — | — | ✓ GCP 1.4 |