https://logs.munagalakarthik.com/ Notes on LLMs, cloud security, and systems by Munagala Karthik. en-IN Wed, 01 Jul 2026 00:00:00 +0530 https://logs.munagalakarthik.com/post.html?slug=llm-evals-that-catch-regressions https://logs.munagalakarthik.com/post.html?slug=llm-evals-that-catch-regressions Sat, 20 Jun 2026 00:00:00 +0530 Benchmark scores do not tell you if Tuesday's prompt change broke your checkout flow. Here is the eval setup I use to catch real regressions in production features. https://logs.munagalakarthik.com/post.html?slug=guardduty-findings-worth-paging https://logs.munagalakarthik.com/post.html?slug=guardduty-findings-worth-paging Fri, 12 Jun 2026 00:00:00 +0530 GuardDuty is noisy until you decide what actually needs a human in the first ten minutes. Here is how I tier findings so on-call stops ignoring the channel. https://logs.munagalakarthik.com/post.html?slug=rag-grounding-before-shipping https://logs.munagalakarthik.com/post.html?slug=rag-grounding-before-shipping Fri, 05 Jun 2026 00:00:00 +0530 Retrieval makes answers feel smart fast. It also makes wrong answers feel confident. These are the grounding checks I run before a RAG feature goes live. https://logs.munagalakarthik.com/post.html?slug=scp-patterns-every-aws-org https://logs.munagalakarthik.com/post.html?slug=scp-patterns-every-aws-org Wed, 27 May 2026 00:00:00 +0530 Service Control Policies are the cheapest, highest-leverage security control AWS gives you. Here are the four I put in place on day one of a new org. https://logs.munagalakarthik.com/post.html?slug=prompt-injection-defenses-that-hold https://logs.munagalakarthik.com/post.html?slug=prompt-injection-defenses-that-hold Fri, 22 May 2026 00:00:00 +0530 Most "prompt injection defenses" are wishful thinking dressed up as engineering. Here is the short list of patterns that survive a real red-team week. https://logs.munagalakarthik.com/post.html?slug=eventbridge-iam-detection-rules https://logs.munagalakarthik.com/post.html?slug=eventbridge-iam-detection-rules Wed, 20 May 2026 00:00:00 +0530 CloudTrail tells you what happened. EventBridge tells you the moment it happens — if you can write the pattern without paging on every CI deploy. https://logs.munagalakarthik.com/post.html?slug=cloudtrail-first-queries-suspicious-iam https://logs.munagalakarthik.com/post.html?slug=cloudtrail-first-queries-suspicious-iam Thu, 14 May 2026 00:00:00 +0530 When someone says "something odd happened in IAM," you do not need a fancy SIEM on day one. CloudTrail already has the story — if you know which events to pull first. https://logs.munagalakarthik.com/post.html?slug=iam-privilege-escalation-patterns https://logs.munagalakarthik.com/post.html?slug=iam-privilege-escalation-patterns Sun, 10 May 2026 00:00:00 +0530 AWS IAM privilege escalation isn't about zero-days. It's about abusing legitimate permissions in ways the account owner didn't intend. Here are the patterns that come up most often. https://logs.munagalakarthik.com/post.html?slug=hello-world-why-i-started-logs https://logs.munagalakarthik.com/post.html?slug=hello-world-why-i-started-logs Thu, 07 May 2026 00:00:00 +0530 LLM Engineer and Cloud Security Engineer—models in production, AWS IAM and guardrails, and the overlap between the two. This is my corner of the internet.