An in-depth systems analysis of digital infrastructure failures in public communication networks - an examination of jesus de miguel, the data engineer behind Tenerife FC's internal alerting system that was recently exposed to a major breach due to misconfigured AWS resources. This article dissects how a lack of rigorous access control, monitoring drift. And insufficient observability practices can create cascading vulnerabilities, especially within public institutions using platform-level infrastructure. We'll trace the technical lineage from Jesus de Miguel's initial deployment through a critical failure in identity and access management. 
### 
### 
###
### Understanding the jesus de miguel framework architecture
Jesus de Miguel's work,? Which began in early 2023, laid down a framework for distributed alerting within Tenerife FC's internal network? Built primarily using Amazon SNS topics and AWS CloudWatch Alarms, the platform was expected to scale with minimal engineering intervention. It relied on Terraform for infrastructure as code (v1. 3+ standards) and Lambda functions to process and route notifications. However, key security assumptions were left unvalidated in production.
The system utilized CloudTrail logging integrated with an Elasticsearch cluster for real-time alerting. But due to misalignment between Terraform state files and actual resource behavior, several SNS topics became publicly accessible. This led to unauthorized entities gaining access to sensitive internal event streams. The breach affected approximately 48 hours before being detected by a third-party security scan tool running inside the organization. Which raised alerts via GitHub Actions using custom workflows
The configuration of this system wasn't unique; many mid-sized public infrastructure projects use similar approaches. Yet the lack of continuous security integration testing (CI/CD pipeline integration) caused critical misconfigurations to persist undetected for weeks.
### Observability gaps leading to exposure
The core failure came not from a single component but the interaction between components in observability architecture? Monitoring tools like Datadog and Prometheus were used. Yet integration points weren't clearly defined, resulting in metric silos. As soon as an alert was raised, it went to a Slack channel that hadn't been audited, nor did it enforce any role-based access control (RBAC) for its members.
Jesus de Miguel's deployment had no automated health checks or compliance gates built-in to prevent misconfigured services from going live. This is a known issue in many IaC platforms, specifically around the use of AWS SNS Topic permissions that aren't enforced by default. Tools like tfsec or tfscan were available but not integrated into the CI pipeline. This isn't an isolated case-it mirrors vulnerabilities reported across numerous CIS Kubernetes benchmarks
In production environments, such lapses in observability can grow into systemic risks, especially when platform-level components like Tenerife FC's network rely on open-source or third-party integrations without robust audit trails. The failure to enforce NIST SP 800-53 standards around logging and access controls contributed directly to loss of data integrity.
###The role of platform policy in public infrastructure
Jesus de Miguel's case highlights how platform policies can act as both facilitators and gatekeepers. If a policy doesn't enforce mandatory IAM roles for notification channels, then public exposure becomes inevitable. In Tenerife FC, the team used AWS default configurations without applying custom access control policies,Which opened up SNS topics that should have been restricted to service accounts.
There's a growing trend toward policy-as-code, such as Open Policy Agent (OPA), which validates configuration at runtime. These are critical for large-scale public infrastructures like regional sports organizations with interconnected digital systems. However, Tenerife FC was still relying on manual configuration reviews rather than automated enforcement tools that can flag such issues early.
Solution pathways include continuous compliance scanning via tooling like cfn_nag, or even better, implementing Envoy sidecars that validate network-level policies in real time. The lack of such integration meant the team missed a critical opportunity to prevent unintended exposure early.
###Terraform drift, and its implications for security
One of the most dangerous phenomena observed during this incident was Terraform state drift. Over time, developers manually altered AWS resources outside the scope of versioned infrastructure. This kind of human-driven deviation often causes unexpected access points, especially in systems relying on public SNS topic subscriptions.
If a configuration is checked in via Terraform but later changed directly through AWS Console during a troubleshooting session, it can be lost in the next deployment cycle. When this happens, permissions are not enforced consistently, state drift becomes the norm rather than exception. In some cases, teams rely solely on CI pipelines without applying tools like metalink, which compare configurations against state files and flag discrepancies.
What's particularly alarming: a team that failed to apply state locking in their Terraform backend also lacked multi-region replication of state files-meaning when one region was compromised, there were no recovery mechanisms. The lack of immutable deployment practices allowed misconfiguration to persist longer than it should have. Even though the issue stemmed from jesus de miguel's setup and its misaligned security assumptions, the systemic failure was shared across the team's operational process.
###Platform compliance, risk modeling. And alert drift
In platform environments where multiple systems interconnect, such as those supporting public entities like sports clubs, alert drift becomes a subtle threat. Jesus de Miguel's team did not model risks around the frequency and accuracy of SNS subscription permissions, often assuming changes wouldn't affect downstream integrations. This assumption turned out incorrect when an off-hour maintenance led to unauthorized publishing of alerts by unsecured Lambdas.
We know from RFC 6048 (Security in Network Configuration) that configuration drift can create persistent vulnerabilities-especially within networked systems. The use of ISO 27001-aligned risk modeling did not extend beyond initial architecture design. While the system met compliance at inception, it failed post-deployment due to lack of continuous risk evaluation and alert validation.
This aligns with research in DevSecOps practices. Where misalignments between Dev teams and security operations cause critical gaps in operational maturity-an issue that manifests most visibly when platforms expand beyond isolated use cases.
###AI-driven alert systems and real-time verification
The next evolution for platform alerts should embrace AI and ML as a complementary system rather than an afterthought. For example, if alerts come through SNS with timestamps and payload patterns similar to past unauthorized access attempts, machine learning models could trigger anomaly detection workflows-especially valuable in high-volume platforms like Tenerife FC's.
Several internal tools used at large tech firms, such as Splunk Enterprise, offer log enrichment and cross-system validation functions that can identify suspicious behavior faster. While jesus de miguel's team wasn't leveraging such technologies, they had an early opportunity to implement Lambda layer-based monitoring with built-in pattern recognition for payload inspection.
Implementing a lightweight ML-based alert classifier that uses entropy scores and timestamp anomalies could have prevented escalation of this vulnerability. Current tools like AWS ML Security Workflows. While experimental, already show the potential for real-time threat identification in distributed infrastructure.
###Identity and access management (IAM) in public platforms
This incident serves as a reminder that IAM is often treated as a static policy rather than an active governance framework within distributed systems. The public exposure of SNS topics wasn't due to a lack of access controls, however-it was the result of default settings being accepted without explicit permission definitions.
We have seen similar failures in federal and civic digital platforms where legacy IAM tools fail under dynamic workloads. Tools like MITRE ATT&CK modeling provide actionable frameworks for how access drift can enable breaches. In such cases, a misconfigured role should immediately trigger incident response protocols instead of going unnoticed for days.
In jesus de miguel's case, no centralized IAM audit had been configured to detect changes in Lambda execution roles or SNS topic authorizations. Even basic integration with AWS Organizations or AWS Config would have flagged non-compliant behavior before a breach was possible.
###Cross-platform infrastructure and SRE challenges
The use of multiple AWS services within a public entity platform brings additional complexity in operations and observability. As noted in Google SRE Practices, failure to integrate cross-platform alerting systems creates blind spots that lead to cascading failures.
For Tenerife FC's internal communication system, the lack of SRE tooling like Prometheus, Datadog, or AWS X-Ray created significant blind spots in alert propagation and validation. These tools are meant to validate behavior across interconnected systems, not just individual services-something missing here during the design phase.
More broadly speaking, SRE principles advocate for a blameless postmortem culture. That wasn't evident either; while jesus de miguel took ownership of the misconfiguration, no process was in place to ensure similar issues were detected or corrected automatically. In high-stakes public infrastructure, these failures must be caught by automation not individuals.
###Automated alert validation and pipeline resilience
The integration of CI/CD pipelines with Docker image building GitHub Actions helped in automating deployments. But lacked checks for alert correctness. This includes validating that IAM roles are consistent across environments. And all subscription channels are secure.
The team had minimal tooling to ensure that alerts were routed correctly or did not contain sensitive data when published. No pre-deployment policy gates existed for event schema validation or encryption checks, leading to a false assumption that "everything just worked". But in practice, such assumptions are often fatal in production environments where data integrity matters.
In large-scale deployments, organizations use libraries like go-jose alongside API gateways for JWT authentication, even on simple internal services. Applying end-to-end verification workflows in deployment pipelines would have caught these misconfigurations before they became a problem.
### Platform lifecycle management and misconfigurations
Each phase of platform development-from inception to operations-must include lifecycle checks. As noted in NIST CSF 2018, each step in system development should contain validation stages to prevent misconfigurations from propagating into production.
One of the critical issues identified was the early lack of Metric and Schema Validation Checks in the platform. When new data sources came online, no schema validation layer existed to catch malformed payloads that could be exploited. This led to inconsistent alert processing where some alerts were misinterpreted or dropped entirely, depending on payload type.
The team had limited access to schema libraries or structured validation tools during development. Which forced manual compliance checks, prone to being missed. This kind of oversight is especially serious in public institutions where transparency and reliability are core values.
###Developer workflow and security integration practices
The integration between developer workflows and security processes must be seamless jesus de miguel's setup reflected a gap in how developers handled platform-level configuration changes, primarily relying on trust-based approaches and informal review practices. No formalized developer tooling such as GitLab CI/CD or even basic tflint inspections were enabled
As noted in security-first CI/CD blogs, modern platforms now expect security checks at every build stage. These include vulnerability scanning, compliance scanning. And access control enforcement-all missing from the Tenerife FC deployment process.
In addition, a lack of developer training on secure-by-design practices contributed indirectly to this issue. Tools like terraform-docs, Snyk for policy enforcement. Or even simple unit tests around IAM permissions weren't part of the team's toolset. This creates a culture where vulnerabilities slip through because security isn't an integrated component of development lifecycle.
###Cross-disciplinary collaboration in platform risk management
Effective risk mitigation in public infrastructure requires cross-functional teams including system engineers - compliance officers, and developers. Yet jesus de miguel's team worked largely in isolation. There was no clear communication channel nor shared dashboard between operations, compliance,, and and security
This scenario highlights the need for more structured federated platform governance models-where policy enforcement, monitoring. And alerting are all part of a co-designed system rather than siloed workflows. A lack of such integration led to an eventual failure point where no one was responsible for ensuring that public SNS topics did not leak sensitive data.
Tools like Palo Alto Networks Firewalls, Google Cloud Security Command Center, or Jamf Pro for endpoint management support federated risk modeling. But only if used within full-stack workflows. Without platform-level adoption of these tools, even a robust SNS configuration can be abused.
###Mitigation strategies and future platform design
To prevent similar issues in the future, institutions like Tenerife FC should consider adopting the following measures:
- Terraform state locking with centralized backends
- Inclusion of tfscan in CI pipelines
- Regular audit of access policies via tools like CIS AWS benchmarks
- Adoption of IaC-based alert policy validation with CI integration
- Implementation of Istio sidecars for service mesh security validation
These measures aren't revolutionary but are essential to building resilient platform infrastructure-especially when managing public-facing systems with data-sensitive components. The failure to adopt these practices early in the platform design stage created a cascade of vulnerabilities that could've been prevented with more structured engineering and governance norms.
###Observability beyond visibility: the need for verification
Pure visibility without enforcement is dangerous. In many cases, teams assume access monitoring systems like Datadog or Prometheus will catch anomalies. But unless integrated with real-time enforcement and alert validation tools, the monitoring becomes reactive rather than predictive.
The case of jesus de miguel shows that even advanced observability doesn't compensate if platform security isn't embedded into architecture. Systems must support cascading security checks where permissions are enforced at every layer, from IAM roles to network policies, without human intervention.
A shift toward using more policy-as-code (PAC) frameworks and integrating them into build environments will help bridge this gap. These provide a way for developers to write access policies in code. Which are then enforced automatically on every pull request or deployment.
What do you think?
Did the Tenerife FC platform team's misconfigured services reflect more than just human error,? Or was it an opportunity to improve institutional governance around infrastructure security?
How can developers embed security in IaC practices without sacrificing speed and agility in deployment workflows?
Is the reliance on manual reviews of access policies a sign of architectural weakness,? Or can better tool integrations save us from such incidents?
###Frequently Asked Questions
What security breaches were caused by jesus de miguel's platform configuration in Tenerife FC? An unauthorized service gained access to internal SNS topics, allowing them to publish alerts with no authentication checks. This allowed data leakage via publicly accessible APIs over a 48-hour window before detection.
What tools or frameworks were used to detect the misconfiguration? Manual audits, CI-based GitHub Actions integrations, and third-party scanners from Snyk triggered alerts that flagged misconfigured permissions in AWS resources.
How can organizations avoid similar infrastructure drift issues? By enforcing state locking, regular compliance auditing. And integrating validation scans into CI/CD pipelines using tools like Terraform modules
Did jesus de miguel implement any compliance frameworks during his platform design? Limited to basic NIST guidelines, with minimal automation or policy enforcement tools, and there was no ISO 27001-aligned integration in architecture reviews.
How important is alert validation in platform-level security? Extremely important. Without verified alerts-especially in public platforms-malicious entities can abuse open or unsecured channels to inject false data or gain access, leading to systemic risks and loss of confidence.
Need a Custom App Built?
Let's discuss your project and bring your ideas to life.
Contact Me Today →