Sign in Subscribe
Carlo Mencarelli

Carlo Mencarelli

Colorado, United States
Security Leader @ HackerOne. I write about the cloud, infrastructure engineering, cybersecurity, and engineering leadership. Maybe other things sometimes too.
A red neon sign reading “SECURITY” outlined in blue glows indoors, with a matching neon arrow beneath it and the reversed reflection of the sign visible on a polished wall to the right.
aws

Carlo's Top AWS Announcements of 2025

As 2025 wraps up, I’m looking back at AWS’s biggest releases. From multi-account console sign-in to org-level S3 block public access and full SCP language support. It’s been a year of long-awaited upgrades that make AWS more secure, flexible, and finally a bit easier to live with.
Display of various hats in a store, featuring a stack of cartoon-face bucket hats in the foreground
aws self-improvement

Enabling Myself by Automating Bureaucracy

Faced with the realization that I wasn't good at ticket grooming and kanban management, I built a helper prompt and script that looks at GitLab issues, provides suggestions, and gives me a brief summary. Here I spend a few minutes reflecting on the what, how, and why it matters to you.
S3 Pre-signed URLs and Web Archiving
aws security

S3 Pre-signed URLs and Web Archiving

Pre-signed S3 URLs offer secure, temporary access, but what if they get archived and exposed? Learn how these URLs work, the risks of web archiving, and steps you can take to prevent accidental data leaks.
How to Know When You Are Throttled by Amazon's IMDS
aws observability

How to Know When You Are Throttled by Amazon's IMDS

You might not realize how often your instance accesses the metadata service(IMDS) for credentials. I faced puzzling failures that standard debugging couldn't explain. The cause? A little-known packet-per-second limit on link-local services. In this post, I’ll share my findings and solutions.

Episode

00:00:00 00:00:00