Founder Engineering Field Notes

Practical engineering lessons based on verified software work: real failure signatures, actual root causes, minimal validated corrections, and the controls that should have caught the problem earlier.

Published field notes

A Successful Docker Build Does Not Mean You Built a Runnable Release

CI should start and health-check the exact container image before publishing it, because a successful image build does not prove the packaged process can run.

Verified against current public documentation: 2026-09-23

CloudFormation Generated Role Names Can Break Least-Privilege IAM Twice

When CloudFormation generates IAM role names, least-privilege policies must match the physical role identity on both the forward and rollback paths.

Verified against current public documentation: 2026-09-23

CloudFormation Least Privilege Can Fail Outside the Service You Think You Are Deploying

CloudFormation resource operations can depend on adjacent-service APIs, so least-privilege fixes should follow the exact denied action rather than the template’s obvious service boundary.

Verified against current public documentation: 2026-09-23

GitHub Actions OIDC AccessDenied May Be a Trust-Policy Problem, Not a Permission-Policy Problem

When GitHub Actions cannot assume an AWS role, diagnose OIDC trust claims before widening the role’s service permissions.

Verified against current public documentation: 2026-09-23