https://hool.co AWS benchmarks measured in AWS, practical guides with primary sources, and what changed at the vendors engineers build on. en-us Thu, 12 Nov 2026 12:00:00 GMT https://hool.co/reports/microsoft-365-outage-november-12-2026-exchange-online-teams https://hool.co/reports/microsoft-365-outage-november-12-2026-exchange-online-teams Thu, 12 Nov 2026 12:00:00 GMT Internet Fundamentals Outlook, Exchange Online, Teams, SharePoint, Copilot and Defender XDR went down worldwide on the afternoon of November 12. Microsoft says servers are failing health checks and overloading the rest. What we know, what happens to email sent to you in the meantime, and what to check once it is back. https://hool.co/reports/aws-spend-limits-hard-cap-how-it-works-what-pauses https://hool.co/reports/aws-spend-limits-hard-cap-how-it-works-what-pauses Mon, 09 Nov 2026 12:00:00 GMT Cost Optimization AWS now has a hard spending cap. A project in the new AWS experience pauses when it reaches its monthly limit instead of billing past it: every resource stops, S3 included, and data is kept for 90 days. It covers all of the project's charges, egress too, but only for projects created through the new signup experience. Not existing accounts, and not Organizations, yet. https://hool.co/guides/aws-spend-limits-vs-budgets-budget-actions-cost-anomaly-detection https://hool.co/guides/aws-spend-limits-vs-budgets-budget-actions-cost-anomaly-detection Mon, 09 Nov 2026 12:00:00 GMT Cost Optimization AWS now has four cost controls that sound alike and behave very differently. Budgets alert, budget actions apply a policy or stop EC2 and RDS instances, Cost Anomaly Detection flags unusual spend, and spend limits pause an entire project at a hard cap. What each one actually stops, how fast, and where each fits. https://hool.co/guides/aws-spend-limits-limitations-existing-accounts-organizations-per-resource https://hool.co/guides/aws-spend-limits-limitations-existing-accounts-organizations-per-resource Mon, 09 Nov 2026 12:00:00 GMT Cost Optimization Spend limits only work on projects created through the new AWS signup experience, can't cover an existing account or an organization, can't spare production while stopping the rest, and pause everything at once. Each limitation, what it means in practice, and the workaround until AWS extends the feature. https://hool.co/guides/build-your-own-aws-spend-cap-existing-account-budget-actions-scp https://hool.co/guides/build-your-own-aws-spend-cap-existing-account-budget-actions-scp Mon, 09 Nov 2026 12:00:00 GMT Cost Optimization Spend limits don't cover existing AWS accounts yet. You can build most of the same protection today: budget actions that apply a deny policy or stop instances at a threshold, service control policies that keep accounts away from the most expensive services, lower quotas, and anomaly alerts. The setup, in order, and the gaps it leaves. https://hool.co/reports/database-failover-downtime-aws-rds-multi-az-vs-aurora-measured https://hool.co/reports/database-failover-downtime-aws-rds-multi-az-vs-aurora-measured Mon, 09 Nov 2026 12:00:00 GMT Data Platform We wrote to Postgres every 50 ms and forced failovers. RDS Multi-AZ lost writes for 13.0 and 14.8 seconds; in one trial the switch began three minutes after the reboot was requested. Aurora PostgreSQL lost writes for 2.0 and 0.5 seconds, one failed write each time. The full timelines, the errors your application will see, and what to set so it recovers on its own. https://hool.co/reports/aurora-serverless-v2-resume-from-zero-and-scaling-measured https://hool.co/reports/aurora-serverless-v2-resume-from-zero-and-scaling-measured Mon, 09 Nov 2026 12:00:00 GMT Data Platform With auto-pause at 0 ACUs, the first query after a pause took 21.4 and 13.6 seconds to answer. Under sustained CPU load, the cluster went from 2 ACUs to its 16-ACU maximum in about two minutes, and tail latency fell from 24 seconds to 5. What that means for scale-to-zero databases behind real users. https://hool.co/reports/lambda-cold-starts-postgres-rds-proxy-dynamodb-vpc-measured https://hool.co/reports/lambda-cold-starts-postgres-rds-proxy-dynamodb-vpc-measured Mon, 09 Nov 2026 12:00:00 GMT Serverless Node.js 22 functions on arm64 took 570–650 ms end to end on a cold start, whether they talked to Postgres directly, through RDS Proxy, or to DynamoDB, and a function in a VPC was no slower than one outside it. Bursts of 200 simultaneous cold starts all succeeded. Warm, RDS Proxy added about 3 ms per query. https://hool.co/reports/dynamodb-vs-postgres-measured-in-aws-53-workloads https://hool.co/reports/dynamodb-vs-postgres-measured-in-aws-53-workloads Mon, 09 Nov 2026 12:00:00 GMT Data Platform We ran 53 workloads against RDS Postgres 17 and DynamoDB from one Fargate task in the same Availability Zone, at 100,000, 1 million and 5 million orders. Key lookups took 0.35 ms in Postgres and 2.7 ms in DynamoDB; a two-item transaction 1.75 ms against 20 ms; a question nobody designed for, 0.08–2.7 s against a full table scan. The full results, with the method and every caveat. https://hool.co/reports/ad-hoc-queries-dynamodb-vs-postgres-16-analytics-questions-measured https://hool.co/reports/ad-hoc-queries-dynamodb-vs-postgres-16-analytics-questions-measured Mon, 09 Nov 2026 12:00:00 GMT Data Platform Every question across customers is a full table scan in DynamoDB: 217,000 read units at 5 million orders, whether it returns 10 rows or all of them. Postgres answered the same 16 questions in 0.08 to 2.7 seconds without a single index added for them, and an index built in 2.7 seconds took one from 148 ms to 44 ms. Measured in AWS. https://hool.co/reports/postgres-connection-limits-rds-1600-connections-with-and-without-rds-proxy https://hool.co/reports/postgres-connection-limits-rds-1600-connections-with-and-without-rds-proxy Mon, 09 Nov 2026 12:00:00 GMT Data Platform db.m7g.large allows 832 connections. When 1,600 clients connected at once, 916 were refused; through RDS Proxy all 1,600 succeeded, with the slowest waiting 12 seconds. The measurements at 100, 400, 800 and 1,600, the errors you'll see, and what a fresh AWS SDK client per request does under the same burst. https://hool.co/reports/concurrent-transactions-postgres-dynamodb-deadlocks-lock-order-measured https://hool.co/reports/concurrent-transactions-postgres-dynamodb-deadlocks-lock-order-measured Mon, 09 Nov 2026 12:00:00 GMT Data Platform Moving money between 10 accounts with 64 concurrent workers, Postgres committed 5 transfers a second when rows were locked in random order (50 deadlocks, median wait 24 s) and 1,185 a second when locked in a fixed order. DynamoDB committed 228 a second and cancelled 14,344. Also: hot counters, sharding, and serializable isolation. https://hool.co/reports/postgres-jsonb-performance-gin-jsonb-path-ops-expression-index-measured https://hool.co/reports/postgres-jsonb-performance-gin-jsonb-path-ops-expression-index-measured Mon, 09 Nov 2026 12:00:00 GMT Data Platform On a million documents, an expression index took a JSONB field lookup from 75 ms to 0.17 ms. On line items, jsonb_path_ops beat the default GIN operator class on every count: 1.3 ms against 4.1 ms per query, a 10% smaller index and a build 2.5 times faster. Plus what 256 KB documents cost to read and update. https://hool.co/reports/postgres-as-a-job-queue-skip-locked-listen-notify-throughput-rds https://hool.co/reports/postgres-as-a-job-queue-skip-locked-listen-notify-throughput-rds Mon, 09 Nov 2026 12:00:00 GMT Data Platform A plain table with FOR UPDATE SKIP LOCKED processed 6,570 jobs a second with 32 workers on a 2-vCPU RDS instance; adding workers past that made it slower. LISTEN/NOTIFY delivered 16,000 notifications a second with a median delivery time of 0.57 ms. When that is enough, and when to reach for SQS. https://hool.co/reports/postgres-row-level-security-performance-tenant-policy-measured https://hool.co/reports/postgres-row-level-security-performance-tenant-policy-measured Mon, 09 Nov 2026 12:00:00 GMT Data Platform With a common multi-tenant policy (customer_id = current_setting('app.customer_id')::int), the same "latest 20 orders" query took 58 ms instead of 0.31 ms with an explicit WHERE clause, on a million rows with the right index in place. What we measured, why it happens, and how to write policies that keep their indexes. https://hool.co/reports/postgres-write-performance-batch-size-indexes-foreign-keys-prepared-statements https://hool.co/reports/postgres-write-performance-batch-size-indexes-foreign-keys-prepared-statements Mon, 09 Nov 2026 12:00:00 GMT Data Platform Inserting 20,000 rows one statement at a time ran at 775 rows a second; 1,000 rows per statement ran at 156,789, two hundred times faster on the same connection. Prepared statements nearly doubled read throughput. Each extra index cost about 3–4% of insert throughput, and a foreign key about 8%. https://hool.co/reports/dynamodb-read-your-own-writes-secondary-index-stale-90-percent https://hool.co/reports/dynamodb-read-your-own-writes-secondary-index-stale-90-percent Mon, 09 Nov 2026 12:00:00 GMT Data Platform Right after writing an item, a query on a global secondary index didn't find it in 269 of 300 tries. Secondary indexes are eventually consistent, and "eventually" was longer than one request. What that means for "save, then show the list" screens, what strong consistency costs, and how long adding a new index took. https://hool.co/reports/postgres-pagination-count-bloat-offset-vs-keyset-vacuum-measured https://hool.co/reports/postgres-pagination-count-bloat-offset-vs-keyset-vacuum-measured Mon, 09 Nov 2026 12:00:00 GMT Data Platform Page 45,000 of a table with OFFSET took 134 ms; the same page by keyset took 0.27 ms. An exact count of a million rows took 103 ms against 0.12 ms for the planner's estimate. Five full-table updates grew a table from 15 MB to 92 MB, and VACUUM didn't give any of it back. https://hool.co/reports/postgres-search-without-elasticsearch-full-text-trigram-ilike-measured https://hool.co/reports/postgres-search-without-elasticsearch-full-text-trigram-ilike-measured Mon, 09 Nov 2026 12:00:00 GMT Data Platform A trigram index took an address search on 5 million rows from 2.7 s to 95 ms. On a million documents of common words, the same kind of index made a phrase search slower than no index at all (1.8 s against 1.2 s), while full-text search answered in 263 ms. When each one works, with build times and sizes. https://hool.co/reports/pgvector-on-rds-hnsw-ivfflat-build-time-latency-measured https://hool.co/reports/pgvector-on-rds-hnsw-ivfflat-build-time-latency-measured Mon, 09 Nov 2026 12:00:00 GMT AI Engineering On 50,000 vectors of 768 dimensions on a 2-vCPU RDS instance, an exact nearest-neighbour search took 133 ms. HNSW cut it to 1.9 ms after a 47-second build; IVFFlat to 1.8 ms after 2.4 seconds. What recall looked like, why our numbers are a floor, and how to size this for real embeddings. https://hool.co/reports/noisy-neighbour-postgres-dynamodb-key-lookups-during-reports-and-spikes https://hool.co/reports/noisy-neighbour-postgres-dynamodb-key-lookups-during-reports-and-spikes Mon, 09 Nov 2026 12:00:00 GMT Data Platform Key lookups in Postgres went from 0.16 ms to 9.75 ms, about 60 times slower, while four reporting queries ran on the same 2-vCPU instance. In DynamoDB, lookups stayed at 2.5 ms during a parallel scan of the same table. And what a jump from 10 to 1,000 concurrent clients did to each. https://hool.co/guides/what-is-mcp-model-context-protocol-servers-clients-tools-authorization https://hool.co/guides/what-is-mcp-model-context-protocol-servers-clients-tools-authorization Mon, 09 Nov 2026 12:00:00 GMT AI Engineering MCP (the Model Context Protocol) is the standard way an AI application connects to tools and data: Claude, ChatGPT, Cursor and VS Code speak it, and any company can publish a server. MCP explained in plain terms: the parts, what a server exposes, the two transports, how authorization works since the 2026 spec, where the security risks are, and when building a server is worth it. https://hool.co/guides/idle-dev-test-ec2-rds-overnight-schedules-and-savings https://hool.co/guides/idle-dev-test-ec2-rds-overnight-schedules-and-savings Mon, 09 Nov 2026 12:00:00 GMT Cost Optimization A dev environment used 12 hours on weekdays sits idle 64% of the week. Scheduling it off saves most of its compute bill, but some charges keep running and RDS restarts itself after seven days. What to schedule, with which AWS tool, what still costs money when everything is stopped, and the settings that keep it from annoying the people who work late. https://hool.co/guides/aws-account-suspended-or-closed-without-warning-how-to-protect-production https://hool.co/guides/aws-account-suspended-or-closed-without-warning-how-to-protect-production Mon, 09 Nov 2026 12:00:00 GMT AWS Architecture A suspended or closed AWS account takes every workload in it offline at once, and recovery runs through support cases, not engineering. The usual causes (failed payments, a compromised account, abuse reports, unanswered verification requests), how reopening works within 90 days of closure, and the setup that keeps production recoverable when it happens to you. https://hool.co/reports/dynamodb-bulk-put-items-load-s3-into-existing-tables https://hool.co/reports/dynamodb-bulk-put-items-load-s3-into-existing-tables Mon, 09 Nov 2026 12:00:00 GMT Data Platform Since November 5, 2026, DynamoDB can write data from files in S3 into a table that already exists, with a condition per item, billed by the gigabyte written rather than by write requests. How it compares with Import from S3 (new tables only) and with BatchWriteItem from your own code, what AWS has and hasn't said about capacity, and what to test before a production backfill. https://hool.co/guides/cognito-vs-better-auth-2026-ai-agents-mcp-cost https://hool.co/guides/cognito-vs-better-auth-2026-ai-agents-mcp-cost Mon, 09 Nov 2026 12:00:00 GMT Security Amazon Cognito is a managed service billed per monthly active user; Better Auth is an open-source TypeScript library that keeps users in your own database. AI changed the comparison in two ways: coding agents now write most of the integration code, and your users increasingly connect AI agents and MCP clients to your product. Prices, what each supports for agents, and how to choose. https://hool.co/guides/lambda-web-functions-vs-event-functions-cost-when-it-saves-money https://hool.co/guides/lambda-web-functions-vs-event-functions-cost-when-it-saves-money Mon, 09 Nov 2026 12:00:00 GMT Serverless Web Functions bill active CPU and held memory; Event Functions bill wall-clock time multiplied by memory. For AWS's own three example workloads, classic Lambda at 512 MB is cheaper. Once requests spend seconds waiting (LLM streaming, slow APIs, long polls) Web Functions win by 40 times or more: a 10-second stream costs about $3 per million requests instead of $134. The arithmetic, the crossover and a checklist. https://hool.co/guides/aws-business-support-plus-what-it-covers-and-alternatives https://hool.co/guides/aws-business-support-plus-what-it-covers-and-alternatives Sat, 07 Nov 2026 12:00:00 GMT AWS Architecture AWS Support now comes as Business Support+ (from $29 a month or a share of your bill), Enterprise (from $5,000 a month) and Unified Operations (from $50,000). What each buys, the common complaints (generic answers, no knowledge of your architecture, nobody to change your code), and when a named engineer on retainer, a partner, or a higher AWS tier is the better fix. https://hool.co/reports/pinpoint-stopped-working-after-october-30-2026-what-broke-and-what-to-do https://hool.co/reports/pinpoint-stopped-working-after-october-30-2026-what-broke-and-what-to-do Sat, 07 Nov 2026 12:00:00 GMT AWS News Pinpoint's engagement features (campaigns, journeys, segments and the analytics behind them) reached end of support on October 30, 2026. If messages stopped going out, a dashboard went flat or your app's analytics calls started failing, this is the triage: how to find every place you used Pinpoint, what still works under AWS End User Messaging, and what to put in place today, this week and this month. https://hool.co/guides/rehost-replatform-refactor-rebuild-migration-strategies-explained https://hool.co/guides/rehost-replatform-refactor-rebuild-migration-strategies-explained Sat, 07 Nov 2026 12:00:00 GMT Migration AWS lists seven migration strategies (retire, retain, rehost, relocate, repurchase, replatform, refactor) and Gartner's older five include rebuild. What each means, what it costs in effort and risk, the AWS tools for each, and how to pick per application rather than for a whole estate. https://hool.co/reports/dynamodb-vs-postgres-benchmark-2026-one-dataset-seven-questions https://hool.co/reports/dynamodb-vs-postgres-benchmark-2026-one-dataset-seven-questions Wed, 04 Nov 2026 12:00:00 GMT Data Platform We loaded the same orders into Postgres 17 and DynamoDB and asked seven questions at 100,000, 1 million and 5 million orders. Lookups by key stayed under 2 ms in Postgres at every size and cost half a read unit in DynamoDB. Every question across customers needed a full Scan in DynamoDB (about 40,000 read units per million orders), and took 0.02 to 1.6 seconds in Postgres. The numbers, and what they mean for choosing. https://hool.co/guides/when-postgres-outperforms-dynamodb-ad-hoc-queries-joins-changing-access-patterns https://hool.co/guides/when-postgres-outperforms-dynamodb-ad-hoc-queries-joins-changing-access-patterns Wed, 04 Nov 2026 12:00:00 GMT Data Platform DynamoDB is excellent at the questions you designed it for. Postgres wins when the questions change: ad-hoc reports, joins, aggregates, filters on any column, and access patterns discovered after launch. Our benchmark: an unplanned query at 5 million orders took 1.2 s in Postgres and 50 ms after a 2-second index build; in DynamoDB it was a full Scan or a new index backfilled across every item. https://hool.co/guides/dynamodb-single-table-design-worked-example-access-patterns-keys-indexes https://hool.co/guides/dynamodb-single-table-design-worked-example-access-patterns-keys-indexes Wed, 04 Nov 2026 12:00:00 GMT Data Platform DynamoDB rewards designing from the questions backwards. A worked example for orders and customers: the access-pattern table, the keys and items, one overloaded secondary index, a sparse index for open orders, and how item size sets the bill (a 4.1 KB item costs twice as much to read as a 4.0 KB one). https://hool.co/guides/dynamodb-scan-cost-dashboard-every-five-minutes-and-alternatives https://hool.co/guides/dynamodb-scan-cost-dashboard-every-five-minutes-and-alternatives Wed, 04 Nov 2026 12:00:00 GMT Data Platform A Scan of a million 327-byte orders reads about 40,000 request units, half a cent. Run it every five minutes for a dashboard and it is $43 a month; at 100 million orders, $4,337. The arithmetic from measured item sizes, and the four alternatives: Stream-fed aggregates, exports to S3 with Athena, zero-ETL to an analytics store, or Postgres. https://hool.co/guides/dynamodb-hot-partitions-per-key-limits-by-item-size https://hool.co/guides/dynamodb-hot-partitions-per-key-limits-by-item-size Wed, 04 Nov 2026 12:00:00 GMT Data Platform Each DynamoDB partition serves up to 3,000 read units and 1,000 write units a second, whatever the table's capacity. One key with 20 KB items tops out at 1,200 eventually consistent reads or 50 writes a second. The limits by item size as a chart, how to spot a hot key, and write sharding when one key really is that busy. https://hool.co/guides/dynamodb-vs-aurora-postgres-cost-by-traffic-where-each-is-cheaper https://hool.co/guides/dynamodb-vs-aurora-postgres-cost-by-traffic-where-each-is-cheaper Wed, 04 Nov 2026 12:00:00 GMT Data Platform For a typical app workload (80% small reads, 20% writes, one secondary index), DynamoDB on-demand costs about $0.30 per million requests: $3 a month at 10 million, $300 at a billion. Aurora Serverless v2 bills for capacity whether or not requests arrive: $43.80 a month at its 0.5 ACU floor, $175 at 2 ACUs. A chart of where the lines cross, and npm data on which way teams are going. https://hool.co/reports/amplify-npm-downloads-2026-share-of-backend-sdks-fell-to-3-5-percent https://hool.co/reports/amplify-npm-downloads-2026-share-of-backend-sdks-fell-to-3-5-percent Wed, 04 Nov 2026 12:00:00 GMT AWS Amplify Among the three backend-as-a-service SDKs (aws-amplify, firebase and supabase-js), Amplify went from 21.4% of monthly npm downloads in November 2024 to 3.5% in October 2026, while Supabase went from 15% to 75%. Inside Amplify, the Gen 1 CLI is still downloaded more than twice as often as the Gen 2 backend package. The data, and what it does and doesn't tell you. https://hool.co/guides/what-amplify-gen-2-deploys-architecture-diagram-and-the-same-app-without-amplify https://hool.co/guides/what-amplify-gen-2-deploys-architecture-diagram-and-the-same-app-without-amplify Wed, 04 Nov 2026 12:00:00 GMT AWS Amplify Behind a few TypeScript files, an Amplify Gen 2 backend is Cognito, AppSync, a DynamoDB table per model, Lambda functions, S3 and nested CloudFormation stacks. Two diagrams: what Amplify creates, and the same app built directly, with a table of each piece, what replaces it, and how hard the move is. https://hool.co/guides/nested-graphql-queries-appsync-amplify-dynamodb-requests-per-screen https://hool.co/guides/nested-graphql-queries-appsync-amplify-dynamodb-requests-per-screen Wed, 04 Nov 2026 12:00:00 GMT AWS Amplify A feed of 20 posts, each with its author and 10 comments with their authors, is one GraphQL query and 241 DynamoDB requests when each relationship resolver fetches per parent. The arithmetic by page size and nesting depth, what it costs per million screen views, and four ways to cut it, from batching to a single Postgres join. https://hool.co/reports/graphql-vs-trpc-npm-downloads-2026-and-when-graphql-earns-its-keep https://hool.co/reports/graphql-vs-trpc-npm-downloads-2026-and-when-graphql-earns-its-keep Wed, 04 Nov 2026 12:00:00 GMT AWS Architecture Over two years, @trpc/server went from 4.6% of graphql's npm downloads to 10.2%, growing 8.2 times against graphql's 3.5, while @apollo/client grew 1.8 times. What the trend says about how teams build APIs now, and the cases where GraphQL is still the right call. https://hool.co/reports/vercel-functions-websockets-generally-available-limits-and-cost https://hool.co/reports/vercel-functions-websockets-generally-available-limits-and-cost Mon, 02 Nov 2026 12:00:00 GMT AWS Architecture Since October 20, 2026, Vercel Functions serve WebSocket connections on every plan, with Express, Hono, Socket.IO, Bun, FastAPI and Next.js. Connections close at the function's maximum duration (300 seconds on Hobby, up to 800 on Pro), each is pinned to one instance, and memory is billed while any connection is open. What that means for your design and your bill. https://hool.co/guides/do-you-need-websockets-decide-before-you-build https://hool.co/guides/do-you-need-websockets-decide-before-you-build Mon, 02 Nov 2026 12:00:00 GMT AWS Architecture A WebSocket demo takes an afternoon. Keeping thousands of connections correct through deploys, reconnects, phones changing networks and a second server takes ongoing work. Many "realtime" features are better served by a 15-second poll or a server-sent event stream. A feature-by-feature guide, and the list of what you take on when the answer really is WebSockets. https://hool.co/guides/realtime-pricing-vercel-websockets-vs-api-gateway-vs-appsync-events https://hool.co/guides/realtime-pricing-vercel-websockets-vs-api-gateway-vs-appsync-events Mon, 02 Nov 2026 12:00:00 GMT AWS Architecture The same workload priced three ways: 1,000 users connected through the workday, 48 million messages a month. On AWS, API Gateway and AppSync Events charge about $1 per million messages and differ mostly in connection minutes and in who does the fan-out. Vercel charges almost nothing per message but bills memory for every instance holding connections. Where each one wins. https://hool.co/guides/nextjs-websockets-on-vercel-upgradewebsocket-redis-fan-out-deploys https://hool.co/guides/nextjs-websockets-on-vercel-upgradewebsocket-redis-fan-out-deploys Mon, 02 Nov 2026 12:00:00 GMT AWS Architecture Next.js has no WebSocket API, so Vercel added upgradeWebSocket() to @vercel/functions 3.10.0. Getting an echo server running takes minutes; a chat or presence feature that works across instances and deploys needs four more pieces. A build order for a production-ready Next.js realtime feature on Vercel. https://hool.co/guides/eks-reference-architecture-2026-diagram-small-team-and-regulated https://hool.co/guides/eks-reference-architecture-2026-diagram-small-team-and-regulated Mon, 02 Nov 2026 12:00:00 GMT Kubernetes What a production EKS setup looks like in 2026, layer by layer: edge, entry, cluster, platform add-ons, data, security and observability. A lean version for a small team on Auto Mode, and a regulated version with separate node pools, network policies and audit logging, with the choices behind each box. https://hool.co/guides/eks-spend-control-requests-consolidation-split-cost-allocation https://hool.co/guides/eks-spend-control-requests-consolidation-split-cost-allocation Mon, 02 Nov 2026 12:00:00 GMT Kubernetes EKS bills are mostly nodes, and nodes are sized by what pods request, not what they use. The leaks we find most (inflated requests, half-empty nodes, cross-AZ chatter, one load balancer per service, clusters on extended support) and how split cost allocation data puts a price on every namespace in the Cost and Usage Report. https://hool.co/guides/eks-hipaa-2026-baa-eligible-services-and-what-you-configure https://hool.co/guides/eks-hipaa-2026-baa-eligible-services-and-what-you-configure Mon, 02 Nov 2026 12:00:00 GMT Healthcare EKS, ECR, Fargate, EBS, EFS and GuardDuty are on AWS's HIPAA eligible services list, so you can run workloads with PHI on Kubernetes under a BAA. Eligibility is not compliance: encryption, access, isolation, audit logs and what lands in your logs are yours. A control-by-control checklist, with a diagram. https://hool.co/guides/eks-and-ai-agents-running-agents-on-eks-and-letting-agents-operate-clusters https://hool.co/guides/eks-and-ai-agents-running-agents-on-eks-and-letting-agents-operate-clusters Mon, 02 Nov 2026 12:00:00 GMT AI Engineering Two different problems. Running agents on EKS is about long-lived workers, GPUs, sandboxes for code they write, and tight egress. Letting an agent operate EKS, through the EKS MCP server or kubectl, is about read-only by default, separate roles for writes, and approvals. The setups that are safe enough to use. https://hool.co/guides/eks-access-entries-pod-identity-retire-aws-auth-configmap https://hool.co/guides/eks-access-entries-pod-identity-retire-aws-auth-configmap Mon, 02 Nov 2026 12:00:00 GMT Kubernetes Access entries replace the aws-auth ConfigMap for people, and Pod Identity replaces IRSA's OIDC plumbing for pods. What each does, what migrates automatically (only the cluster creator), the limits (5,000 Pod Identity associations, no Fargate or Windows), and a migration order that doesn't lock anyone out. https://hool.co/guides/eks-network-policies-vpc-cni-admin-policies-default-deny https://hool.co/guides/eks-network-policies-vpc-cni-admin-policies-default-deny Mon, 02 Nov 2026 12:00:00 GMT Kubernetes The VPC CNI enforces Kubernetes network policies natively, and from version 1.21 adds cluster-wide admin policies that namespace owners can't override. How the tiers are evaluated, a default-deny setup, and the limits: EC2 Linux nodes only, 24 port-protocol combinations per CIDR, and pods without an owner.