This article demonstrates how to use Terraform features new in February 2023 to comprehensively manage permission set assignments in AWS Single-Sign-On / IAM identity Centre across accounts and by Organizational Unit.

Recently I wrote about writing a Golang application with a conversational Artificial Intelligence service - ChatGPT. This is a follow on article about trying to use a similar approach for testing. I am not presuming a familiarity with Golang for this article or claiming a high degree of expertise in it myself. The code discussed in both articles is here.

A new conversational Artificial Intelligence service - ChatGPT - has been making waves this week. I tried using it for a small coding project and was impressed. I think it has some profound implications for the software industry.

I originally set up a portfolio website back in 2016. At the time I was still chasing for Linux Sysadmin and as part of my studies/preparation I had been setting up LAMP/LEMP stacks, on bare metal, in VM's, even on AWS (probably with LightSail, I can't remember). I had some familiarity with Wordpress as a result and didn't really look beyond it for a website solution. I wanted my own domain (so I didn't look at WordPress.com) and I wasn't specifically targeting cloud, so I asked around and went with an old school web hosting provider. It was actually quite a lot of work setting up the site once I got beyond the initial defaults but I liked the result well enough and I didn't need to redo anything very often so it didn't matter so much. As you can see by the posting dates, I don't post that often but certainly there was always maintenance to do...

This post is also published on Medium It’s kind of a standing joke in the industry - do some cool thing with AWS to implement an infrastructure feature, and if it works well, Amazon will come along a few months later with some matching in-house feature. Sometimes that feature might be a relatively simple thing, maybe something that was obviously missing, sometimes you might have had a whole project that was essentially deprecated, and sometimes it’s a feature of a larger piece of work that means you have to adjust or re-evaluate your approach. What do you do when this happens? This article covers an example of each - one that happened with a company I was working with; one that happened with a third-party project we made use of, and one that happened with my own project.

Here's a video of my presentation on 'The Bastion That Isn't There' and a Micro-component approach to Infrastructure using Terraform modules. Given at Sainsbury's London Head Office in December 2019 to the London Hashicorp Users Group. {{< youtube OCdLO65v7-I >}}

I'll be presenting 'The Bastion that isn't there' at Cloud Expo Europe on 12th March 10:55 at the ExCel in London I have a personalised link: ww.cloudexpoeurope.com/JoshuaKite  where you can book a free ticket Meantime you can read my advance interview at Techerati on the journey to enterprise scale: https://techerati.com/features-hub/interviews/the-bastion-server-that-isnt-there/

This article has been edited in Feb 2026 and also been published on Medium

I also have a presentation and live demonstration on the below, so far given at DevSecOps - London Gathering June 13 2018. This article has also been published on Medium The mantras of software as a service, stateless, cattle vs. pets, etc, are often and loudly repeated, but in many environments you often don't have to look too far before you find some big fat pet box sprawling somewhere. Maybe it is the in-house file server, maybe something else, but if your infrastructure is in the cloud then it is most likely going to be your Bastion server (or 'jump box'). Here I look at the problem, look at a couple of options and present a solution that I implemented providing Bastion ssh as a stateless service on AWS - the code is available on GitHub and also published on the Terraform Module Registry. Whilst the principles are applicable universally, this specific solution employs a Terraform plan to deploy to AWS. If you are not using AWS then you might find concentrating on the cloud-config user data stuff more useful as the rest would need to be ported, e.g. for DigitalOcean etc. If you're using GCP then to be honest you probably don't need this at all.

**25 Minute reading time  **(but article is composed of short, numbered sections!)