ReneeBuilds Platform
Each project solves a distinct layer of the identity security problem — from provisioning an identity on day one to auditing its policy posture years later.
Enterprise equivalent: Microsoft Entra ID · Okta · Any OIDC/SAML Identity Provider
Deploys a production-grade Keycloak 26.2.4 instance on RHEL 10 with PostgreSQL 16, TLS hardening, OIDC and SAML 2.0 client configuration, and a Python-automated Joiner-Mover-Leaver lifecycle. Generates real audit events that feed the platform's shared data lake and GRC1 certification workflow downstream.
Enterprise equivalent: CyberArk EPV · BeyondTrust Password Safe
Simulates a production-grade PAM environment using HashiCorp Vault with KV secrets engine, AppRole authentication, Ansible-automated credential rotation, TLS-secured API endpoints, SHA-256 tamper-evident audit logs, and a Flask audit dashboard. Replaces static root tokens and hardcoded credentials with scoped, time-bound machine identities.
Enterprise equivalent: Splunk ES · Microsoft Sentinel · Okta ThreatInsight
Hybrid local-to-cloud SIEM pipeline ingesting Okta system logs via a cron-driven EC2 poller (every 5 min, DynamoDB cursor state) into Kinesis Firehose and an S3 data lake. Lambda triggers on EventBridge failed-login rules, generates AI risk narratives via Amazon Bedrock (Claude Sonnet 4.6), and routes alerts via SNS. Multi-region CloudTrail with ApiCallRateInsight captures AWS control plane activity. QuickSight SOC dashboard connected to Athena dataset. Three GitHub Actions workflows: push-triggered deploy, PR validation (fmt + validate + plan), and scheduled daily drift detection — all running on a self-hosted EC2 runner. Full Terraform infrastructure with remote state in S3.
Enterprise equivalent: AWS IAM Access Analyzer · Wiz · Prisma Cloud
Audits AWS IAM policies for least-privilege violations — wildcard actions, missing MFA conditions, stale credentials, privilege escalation paths. AI-generated risk narratives via Amazon Bedrock (Claude Haiku 3.5) with Guardrails. Async job engine decouples scan execution from the browser request path. CRITICAL findings publish to the P3 SNS topic.
Enterprise equivalent: SailPoint IdentityNow · Saviynt · Any IGA Platform
Automates the quarterly access certification workflow required by SOX and PCI DSS auditors. Consumes real access records directly from P1's PostgreSQL audit tables. AI-assisted certification recommendations via Amazon Bedrock with Guardrails, running asynchronously at campaign launch rather than on page load.
Enterprise equivalent: ServiceNow GRC · Archer · Any Continuous Compliance Platform
Validates that controls are actually operating — not just documented. Ingests P2 rotation logs, P4 IAM audit findings, and cross-project Athena queries to produce a continuous compliance score across PCI DSS, NIST 800-53, SOX, and HIPAA. AI-generated risk narratives per finding with XML context isolation defending against prompt injection.
Enterprise equivalent: SailPoint · Saviynt · Microsoft Entra ID Governance · CrowdStrike Falcon Identity
Programmatic identity governance engine spanning Okta, AWS IAM, Microsoft Entra ID, and GCP — detecting orphaned accounts, inactive credentials, and service account key sprawl concurrently across all four identity planes, then remediating automatically. Entra ID is the canonical source of truth; any account active elsewhere but disabled or absent in Entra triggers a dual-plane disable (Entra PATCH) and deactivate (Okta Management API) in a single reconciliation run. JIT privilege escalation via PIM with real-time webhook telemetry, risk-based Conditional Access enforced after Tor simulation, and a federated AWS data lake joining five telemetry sources in one Athena query. Five Architecture Decision Records document every major design choice. Portfolio site itself migrated to GCP Cloud Storage with Terraform-managed CDN and a keyless GitHub Actions deploy pipeline via Workload Identity Federation.
Compliance Matrix
| Framework | P1 IAM | P2 PAM | P3 SIEM | P4 Audit | GRC1 | GRC2 | P7 Tri-Cloud |
|---|---|---|---|---|---|---|---|
| PCI DSS v4.0 | ✓ Req 7,8,10 | ✓ Req 7,8,10,12 | ✓ Req 10 | ✓ Req 7,8 | ✓ Req 7 | ✓ Req 10 | ◐ Req 8.3.4, 8.4.2 |
| NIST SP 800-53 r5 | ✓ AC-2, IA-2 | ✓ AC-6, IA-5 | ✓ AU-2, SI-12 | ✓ AC-6, AC-2 | ✓ AC-2 | ✓ CA-7 | ◐ AC-2(3), AC-6, IA-2(1) |
| NIST CSF | ✓ PR.AC | ✓ PR.AC, PR.IP | ✓ DE.CM | ✓ ID.AM | ✓ PR.AC | ✓ DE.CM | ◐ PR.AC, DE.CM, RS.RP |
| SOX ITGC | ✓ CC6.1, CC6.2 | ✓ S.404 | ✓ Continuous | ✓ Access ctrl | ✓ CC6.1 SoD | ✓ Oper. eff. | ◐ CC6.1, CC6.2 |
| ISO 27001:2022 | ✓ A.9, A.12 | ✓ A.8.2, A.8.24 | ✓ A.12, A.16 | ✓ A.9, A.18 | ✓ A.9 | ✓ A.18 | ◐ A.5.18, A.8.2 |
| HIPAA Security Rule | — | ✓ §164.308, §164.312 | — | — | ✓ §164.308(a)(3) | ✓ §164.308(a)(8) | ◐ §164.308(a)(3),(5) |
| CIS Benchmarks | ✓ RHEL 10 | — | ◐ AWS planned | ◐ AWS planned | — | — | ◐ GCP 1.4 |