Meet Aidan Steele

Summary of Aidan Steele and awsteele.com

Aidan Steele’s website is primarily a technical blog titled “Aidan Steele’s blog (usually about AWS)”. It functions less like a conventional portfolio page and more like a long-running public engineering notebook: detailed writeups, experiments, reverse-engineering notes, security findings, and small projects, mostly centered on AWS.

Aidan presents himself as a very experienced software developer: in his post about unofax.com, he says he has been writing software for about 25 years, getting paid to do it for about 20, and has had an AWS account for nearly 18 years. He also mentions that his day job is at Square, and that AWS Lambda and Step Functions are among his favorite technologies.

What he works on

The dominant theme is deep AWS engineering, especially around:

• AWS identity, IAM, STS, OIDC, and federation
• Cloud security and vulnerability research
• CloudTrail and audit logging
• Serverless architecture with Lambda, Step Functions, API Gateway, S3, Athena, and CloudFront
• Reverse-engineering AWS internals and undocumented behavior
• Practical tooling and proof-of-concept projects

His writing style is highly technical and investigative. Many posts start from a small oddity in AWS behavior and then drill down into implementation details, edge cases, API behavior, and security implications.

Notable work and projects

A few representative examples:

• AWS access key reverse-engineering — In AWS Access Key ID formats, he reverse-engineered how newer AWS access key IDs encode account IDs, including code to reproduce sts:GetAccessKeyInfo behavior.

• AWS IAM Identity Center vulnerability — In An AWS IAM Identity Center vulnerability, he describes finding and reporting a replay issue involving third-party OIDC tokens without expiry claims. AWS remediated it quickly.

• AWS CloudShell internals — In Deep dive into AWS CloudShell, he investigates CloudShell’s container architecture, Docker-in-Docker setup, credential vending, ECS roles, and defense-in-depth controls.

• Multi-cloud OIDC federation — In Federating into Azure, GCP and AWS with OIDC, he explores how vendors can authenticate into customer environments across AWS, Azure, and GCP using OIDC. He published a companion Terraform/code repo, cloudfed.

• ima.ge.cx — In How ima.ge.cx works, he explains a serverless web frontend for browsing Docker image contents without pulling images locally. The project uses Lambda, Step Functions, S3, S3 Select, and gztool; the code is on GitHub at ima.ge.cx-backend.

• openrolesanywhere — In openrolesanywhere - an IAM Roles Anywhere client, he describes a proof-of-concept CLI for assuming AWS roles using IAM Roles Anywhere with a private key stored in an SSH agent. The repo is openrolesanywhere.

• unofax.com — Aidan and his partner built unofax.com, a small SaaS for sending faxes without signup, paid per page. The project is also a learning vehicle for shipping AI-assisted products end-to-end, including payments, frontend work, customer support, and marketing.

Themes across the site

The site shows Aidan as a developer who is especially strong in cloud infrastructure and security research. He often focuses on practical but subtle topics: AWS credential formats, role assumptions, CloudTrail limitations, Step Functions execution names, principal tags, SCPs/RCPs, Lambda behavior, S3/KMS gotchas, GitHub Actions OIDC, and serverless application architecture.

He is also interested in building small, durable, low-cost services using serverless AWS primitives. His projects tend to favor architectures that can scale to zero and cost almost nothing when idle.

Social links

The site footer links to:

• GitHub: aidansteele
• X / Twitter: __steele

Overall, awsteele.com is a strong technical portfolio for a senior cloud/security engineer: it demonstrates long-term AWS expertise, curiosity about internals, practical serverless development, and a habit of publishing concrete code and reproducible research.