Areeka Aijaz

AWS Security Redesign

Problem: Static AWS credentials in CI/CD pipelines created a critical production security risk — leaked keys could grant unrestricted access.

Solution: Eliminated all static credentials. Introduced IAM role-based architecture with least-privilege policies, OIDC-based authentication for GitHub Actions, and MFA-enforced developer access. Roles are assumed dynamically per deployment context.

Tradeoffs: OIDC adds token exchange latency; role boundaries require careful scoping to avoid over-permissioning. Complexity increases but attack surface shrinks dramatically.

Outcome: Zero static credentials in production. Full audit trail via CloudTrail. Deployment pipeline authenticates without storing secrets.

Architecture & Design

Problem: Production data stored in a single AWS account created a single point of failure — a misconfigured IAM policy or account compromise could destroy backups alongside live data.

Solution: Designed a cross-account S3 replication system managed entirely via Terraform. Backups replicate to an isolated AWS account with strict IAM boundaries. OIDC-based authentication governs cross-account access — no static credentials, no shared keys.

Security Design: The backup account has no write access from production systems post-replication. IAM policies enforce read-only access for recovery operations, preventing ransomware-style overwrites.

Tradeoffs: Cross-account replication incurs additional S3 transfer and storage costs. Accepted as a necessary cost-vs-resilience tradeoff for production data protection.

Problem & Architecture

Problem: Production issues were diagnosed reactively — logs were scattered, unstructured, and required manual SSH access to investigate. Mean time to resolution was high.

Solution: Built a Dockerized observability pipeline: application logs stream to CloudWatch, Logstash ingests and normalizes log events, and Elasticsearch indexes them for real-time querying. Engineers query structured logs directly without touching production servers.

Tradeoffs: Running Logstash and Elasticsearch adds operational overhead — additional containers to maintain, tune, and monitor. The depth of observability gained justifies the complexity for production systems at scale.

Problem & Solution

Problem: The AI computer vision system received raw video uploads in inconsistent formats, resolutions, and codecs. Downstream ML models failed unpredictably on non-standard inputs, causing silent processing errors in production.

Solution: Introduced a proactive normalization stage before any video reaches the ML pipeline. Videos are validated and transcoded to a standardized format asynchronously — the API returns immediately while processing continues in the background. Only normalized video enters the inference pipeline.

Tradeoffs: Async normalization introduces latency before processing begins. Accepted as a consistency-vs-latency tradeoff — predictable ML behavior outweighs the delay for manufacturing quality control use cases.

Problem & Architecture

Problem: Failure Mode and Effects Analysis (FMEA) documentation in manufacturing is time-intensive and requires domain expertise. Engineers needed a way to generate structured FMEA drafts from operational data at scale.

Solution: Integrated an LLM into the backend workflow to generate structured FMEA output from production data inputs. Prompt engineering was used to enforce structured JSON output, reducing post-processing overhead. Prompts were iteratively optimized to minimize token usage and API cost while maintaining output quality.

Tradeoffs: LLM outputs carry hallucination risk — generated FMEA content requires human review before use. The system is designed as a draft-generation assistant, not an autonomous decision-maker. Cost is managed through prompt compression and caching repeated context.