Blog

Standing up two new GCP projects for a payments service migrating from an existing PCI-DSS environment on another cloud, with isolated Terraform state, scoped service accounts, a network and encryption-key layer built from a documented audit question list, and an IAM-only access design for a multi-schema Postgres database.

Building a self-managed NGFW for PCI-DSS compliance as an alternative to Azure Premium Firewall at $1300 per month. Compares FW and NGFW capabilities across layer 7 application awareness, IDS/IPS, identity-based policy, malware scanning, and TLS inspection.