Practical guides on AWS architecture, cost, security, AI and the fundamentals behind apps that have to keep working.
AWS now has four cost controls that sound alike and behave very differently. Budgets alert, budget actions apply a policy or stop EC2 and RDS instances, Cost Anomaly Detection flags unusual spend, and spend limits pause an entire project at a hard cap. What each one actually stops, how fast, and where each fits.
November 9, 2026
6 min read
Spend limits only work on projects created through the new AWS signup experience, can't cover an existing account or an organization, can't spare production while stopping the rest, and pause everything at once. Each limitation, what it means in practice, and the workaround until AWS extends the feature.
November 9, 2026
6 min read
Spend limits don't cover existing AWS accounts yet. You can build most of the same protection today: budget actions that apply a deny policy or stop instances at a threshold, service control policies that keep accounts away from the most expensive services, lower quotas, and anomaly alerts. The setup, in order, and the gaps it leaves.
November 9, 2026
7 min read
MCP (the Model Context Protocol) is the standard way an AI application connects to tools and data: Claude, ChatGPT, Cursor and VS Code speak it, and any company can publish a server. MCP explained in plain terms: the parts, what a server exposes, the two transports, how authorization works since the 2026 spec, where the security risks are, and when building a server is worth it.
November 9, 2026
8 min read
A dev environment used 12 hours on weekdays sits idle 64% of the week. Scheduling it off saves most of its compute bill, but some charges keep running and RDS restarts itself after seven days. What to schedule, with which AWS tool, what still costs money when everything is stopped, and the settings that keep it from annoying the people who work late.
November 9, 2026
7 min read
A suspended or closed AWS account takes every workload in it offline at once, and recovery runs through support cases, not engineering. The usual causes (failed payments, a compromised account, abuse reports, unanswered verification requests), how reopening works within 90 days of closure, and the setup that keeps production recoverable when it happens to you.
November 9, 2026
7 min read
Amazon Cognito is a managed service billed per monthly active user; Better Auth is an open-source TypeScript library that keeps users in your own database. AI changed the comparison in two ways: coding agents now write most of the integration code, and your users increasingly connect AI agents and MCP clients to your product. Prices, what each supports for agents, and how to choose.
November 9, 2026
8 min read
Web Functions bill active CPU and held memory; Event Functions bill wall-clock time multiplied by memory. For AWS's own three example workloads, classic Lambda at 512 MB is cheaper. Once requests spend seconds waiting (LLM streaming, slow APIs, long polls) Web Functions win by 40 times or more: a 10-second stream costs about $3 per million requests instead of $134. The arithmetic, the crossover and a checklist.
November 9, 2026
7 min read
AWS Support now comes as Business Support+ (from $29 a month or a share of your bill), Enterprise (from $5,000 a month) and Unified Operations (from $50,000). What each buys, the common complaints (generic answers, no knowledge of your architecture, nobody to change your code), and when a named engineer on retainer, a partner, or a higher AWS tier is the better fix.
November 7, 2026
6 min read
AWS lists seven migration strategies (retire, retain, rehost, relocate, repurchase, replatform, refactor) and Gartner's older five include rebuild. What each means, what it costs in effort and risk, the AWS tools for each, and how to pick per application rather than for a whole estate.
November 7, 2026
6 min read
DynamoDB is excellent at the questions you designed it for. Postgres wins when the questions change: ad-hoc reports, joins, aggregates, filters on any column, and access patterns discovered after launch. Our benchmark: an unplanned query at 5 million orders took 1.2 s in Postgres and 50 ms after a 2-second index build; in DynamoDB it was a full Scan or a new index backfilled across every item.
November 4, 2026
6 min read
DynamoDB rewards designing from the questions backwards. A worked example for orders and customers: the access-pattern table, the keys and items, one overloaded secondary index, a sparse index for open orders, and how item size sets the bill (a 4.1 KB item costs twice as much to read as a 4.0 KB one).
November 4, 2026
7 min read
A Scan of a million 327-byte orders reads about 40,000 request units, half a cent. Run it every five minutes for a dashboard and it is $43 a month; at 100 million orders, $4,337. The arithmetic from measured item sizes, and the four alternatives: Stream-fed aggregates, exports to S3 with Athena, zero-ETL to an analytics store, or Postgres.
November 4, 2026
5 min read
Each DynamoDB partition serves up to 3,000 read units and 1,000 write units a second, whatever the table's capacity. One key with 20 KB items tops out at 1,200 eventually consistent reads or 50 writes a second. The limits by item size as a chart, how to spot a hot key, and write sharding when one key really is that busy.
November 4, 2026
5 min read
For a typical app workload (80% small reads, 20% writes, one secondary index), DynamoDB on-demand costs about $0.30 per million requests: $3 a month at 10 million, $300 at a billion. Aurora Serverless v2 bills for capacity whether or not requests arrive: $43.80 a month at its 0.5 ACU floor, $175 at 2 ACUs. A chart of where the lines cross, and npm data on which way teams are going.
November 4, 2026
5 min read
Behind a few TypeScript files, an Amplify Gen 2 backend is Cognito, AppSync, a DynamoDB table per model, Lambda functions, S3 and nested CloudFormation stacks. Two diagrams: what Amplify creates, and the same app built directly, with a table of each piece, what replaces it, and how hard the move is.
November 4, 2026
6 min read
A feed of 20 posts, each with its author and 10 comments with their authors, is one GraphQL query and 241 DynamoDB requests when each relationship resolver fetches per parent. The arithmetic by page size and nesting depth, what it costs per million screen views, and four ways to cut it, from batching to a single Postgres join.
November 4, 2026
6 min read
A WebSocket demo takes an afternoon. Keeping thousands of connections correct through deploys, reconnects, phones changing networks and a second server takes ongoing work. Many "realtime" features are better served by a 15-second poll or a server-sent event stream. A feature-by-feature guide, and the list of what you take on when the answer really is WebSockets.
November 2, 2026
7 min read
The same workload priced three ways: 1,000 users connected through the workday, 48 million messages a month. On AWS, API Gateway and AppSync Events charge about $1 per million messages and differ mostly in connection minutes and in who does the fan-out. Vercel charges almost nothing per message but bills memory for every instance holding connections. Where each one wins.
November 2, 2026
6 min read
Next.js has no WebSocket API, so Vercel added upgradeWebSocket() to @vercel/functions 3.10.0. Getting an echo server running takes minutes; a chat or presence feature that works across instances and deploys needs four more pieces. A build order for a production-ready Next.js realtime feature on Vercel.
November 2, 2026
5 min read
What a production EKS setup looks like in 2026, layer by layer: edge, entry, cluster, platform add-ons, data, security and observability. A lean version for a small team on Auto Mode, and a regulated version with separate node pools, network policies and audit logging, with the choices behind each box.
November 2, 2026
8 min read
EKS bills are mostly nodes, and nodes are sized by what pods request, not what they use. The leaks we find most (inflated requests, half-empty nodes, cross-AZ chatter, one load balancer per service, clusters on extended support) and how split cost allocation data puts a price on every namespace in the Cost and Usage Report.
November 2, 2026
7 min read
EKS, ECR, Fargate, EBS, EFS and GuardDuty are on AWS's HIPAA eligible services list, so you can run workloads with PHI on Kubernetes under a BAA. Eligibility is not compliance: encryption, access, isolation, audit logs and what lands in your logs are yours. A control-by-control checklist, with a diagram.
November 2, 2026
7 min read
Two different problems. Running agents on EKS is about long-lived workers, GPUs, sandboxes for code they write, and tight egress. Letting an agent operate EKS, through the EKS MCP server or kubectl, is about read-only by default, separate roles for writes, and approvals. The setups that are safe enough to use.
November 2, 2026
7 min read
Access entries replace the aws-auth ConfigMap for people, and Pod Identity replaces IRSA's OIDC plumbing for pods. What each does, what migrates automatically (only the cluster creator), the limits (5,000 Pod Identity associations, no Fargate or Windows), and a migration order that doesn't lock anyone out.
November 2, 2026
6 min read
The VPC CNI enforces Kubernetes network policies natively, and from version 1.21 adds cluster-wide admin policies that namespace owners can't override. How the tiers are evaluated, a default-deny setup, and the limits: EC2 Linux nodes only, 24 port-protocol combinations per CIDR, and pods without an owner.
November 2, 2026
6 min read
Fargate on EKS bills each pod by vCPU and memory per second: about $18 a month for a 0.5 vCPU, 1 GB pod running all month in US East. No nodes to manage, but no Spot on EKS, no DaemonSets, no Pod Identity and no VPC CNI network policies. The math against nodes, and where each fits.
November 2, 2026
5 min read
Kubernetes ships a minor version about every four months and EKS supports each for 14 months, then 12 more at six times the price. A repeatable upgrade: insights first, control plane, add-ons, nodes, then Fargate pods, with a seven-day rollback window for in-place upgrades and the checks between each step.
November 2, 2026
6 min read
With the VPC CNI every pod takes a real VPC address, so a /24 subnet runs out long before the nodes do. Three fixes: prefix delegation (more pods per node, faster launches), custom networking on a secondary CIDR, or an IPv6 cluster. What each solves, what it costs in complexity, and the migration traps.
November 2, 2026
6 min read
Standard EKS control planes scale themselves and suit almost everyone. Provisioned tiers pin capacity (2,000 to 16,000 API seats, up to 400 pods scheduled a second, 16 GB of etcd) with a 99.99% SLA, from $1.65 an hour (about $1,205 a month) to $13.90. When that is worth it, and how to pick a tier.
November 2, 2026
5 min read
Hybrid Nodes attaches on-premises and edge machines to an EKS cluster: AWS runs the control plane, you run the hardware. It costs $0.020 per vCPU-hour for the first tier (about $467 a month for a 32-vCPU server), needs a reliable link to AWS, and isn't for disconnected sites. Where it beats running Kubernetes yourself.
November 2, 2026
5 min read
Three levels of isolation for teams or customers sharing EKS: namespaces with quotas and network policies, dedicated node pools, or a cluster each. What each actually isolates (containers share a kernel), what it costs (from nothing to $73 a month per cluster plus duplicated add-ons), and how to choose per tenant rather than per platform.
November 2, 2026
6 min read
Pinpoint's segments, campaigns, journeys and analytics ended on October 30, 2026. Sending lives on as AWS End User Messaging and SES; orchestration moves to Amazon Connect, a SaaS tool, or something you build. Four paths, what each is good at, and how to choose.
November 2, 2026
6 min read
A self-hosted replacement for Pinpoint is five parts: first-party events, a profiles table, segments as SQL, sending through SES and End User Messaging, and journeys on Step Functions or Lambda durable functions. What makes it better than Pinpoint ever was: holdout groups that measure real lift, one identity from first visit to revenue, and loops that learn from every send.
November 2, 2026
8 min read
One post gets shared, the bots arrive, and every request runs your code: API Gateway charges for it, Lambda bills the time, and the whole Region shares 1,000 concurrent executions. Worked numbers for a six-hour flood with no firewall, with filtering in code, and with AWS WAF or Cloudflare in front, and why the third is about availability more than money.
November 2, 2026
7 min read
Partners, banks, payroll providers and old integrations still send files over SFTP. AWS Transfer Family gives you a managed SFTP, FTPS, FTP or AS2 endpoint that writes straight to S3 or EFS, for $0.30 an hour per protocol plus $0.04 per GB. What you get for about $219 a month, the setup choices that matter, and the cheaper options when the volume is small.
November 2, 2026
6 min read
Claude Code runs parallel sessions and subagents in git worktrees: separate checkouts on separate branches, sharing one repository. What a worktree shares and doesn't, the one-branch rule, where Claude Code puts them and when it cleans them up, and the things that still collide: dependencies, ports, local databases and .env files.
November 2, 2026
6 min read
Our rule is short: CDK when everything is on AWS, Pulumi over Terraform when it isn't. Pulumi gives you real languages, real tests and an engine you can call from code, and it can use any Terraform or OpenTofu provider, so the ecosystem comes with it. What Pulumi costs, where Terraform is still the better call, and how to move.
November 2, 2026
6 min read
A lakehouse on AWS in 2026 is Apache Iceberg tables in S3, a Glue Data Catalog, and engines like Athena, Redshift and EMR reading the same data. S3 Tables now manages the Iceberg upkeep for you. The layers, what S3 Tables costs on top of storage, when plain Parquet is enough, and the gotchas that make tables invisible.
November 2, 2026
7 min read
The EKS capability for Argo CD costs $0.03 an hour plus $0.0015 an hour per Argo CD Application: about $22 a month, plus about $1.10 per application. Argo CD runs in AWS's control plane, not on your nodes, with Identity Center sign-in. What it costs at 20, 100 and 500 applications, and when self-hosting still makes sense.
November 2, 2026
5 min read
A NAT gateway costs $36.50 a month per AZ before it moves a byte, then $0.045 for every gigabyte, including traffic to S3 and ECR that has a free path. fck-nat is an open-source NAT instance that runs on a t4g.nano for about $3 a month with no per-gigabyte charge. What it costs, what you give up, and how to run it safely.
November 2, 2026
7 min read
Amplify gets a startup to launch fast. The trouble starts later: list queries that scan, resolvers that can't throw or call out, a 30-second ceiling, and a data model that was never designed. The signs it is time to leave, what to move to, what to keep, and a cutover that doesn't log anyone out.
November 2, 2026
7 min read
Most AppSync quotas are generous. The ones that hurt are fixed: a 30-second request ceiling, resolvers in a JavaScript runtime with no try/catch, no async and no network access, 32 KB of resolver code, ten functions per pipeline and 240 KB subscription messages. What each means in practice and the usual workaround.
November 2, 2026
6 min read
Amplify list queries use DynamoDB scans, and DynamoDB applies filters after reading up to 1 MB, so a filtered page costs a full read and can return almost nothing. When the data is relational, Postgres is the better home. How to export, transform, keep the two in sync and switch.
November 2, 2026
6 min read
Real time is often why a team chose AppSync, and the reason they hesitate to leave. Three ways to keep it: AppSync Events at $1 per million operations, API Gateway WebSockets, or server-sent events from your own API. The tradeoffs, and the pattern that makes any of them simple.
November 2, 2026
5 min read
Keep the Cognito user pool, verify the same tokens in the new API, move one screen at a time behind a flag, and keep AppSync alive until old mobile app versions are gone. The order that avoids a big-bang release, and the checks that tell you it is safe to switch off the old backend.
November 2, 2026
5 min read
Building a CRM, an analytics pipeline or a help desk used to be a year of work. With AI coding tools and open-source cores it is weeks. That changes the math on per-seat pricing and on handing your customer data to someone else. When it pays to run your own, when it does not, and what you take on.
October 30, 2026
6 min read
A CRM is contacts, companies, deals, activities and a pipeline view. At $90–$195 per seat per month, ten seats cost $11k–$23k a year. Twenty is an open-source CRM you can run yourself; building on Postgres is the other route. What each option costs, what you lose, and how to migrate without losing history.
October 30, 2026
6 min read
PostHog gives 1M events a month free and is open source, but says self-hosting is unsupported and practical only under about 300,000 events a month. Mixpanel is $10,080 a year at 10M events. A first-party pipeline on Firehose, S3 and Athena costs a few dollars a month at the same volume. What each one is good at.
October 30, 2026
6 min read
GA4 is free because Google gets the data, keeps standard properties to 2 or 14 months of retention, and is blocked by many browsers and extensions. Plausible and Umami can be self-hosted; a first-party collector on your own domain sees the visits blockers hide. The tradeoffs.
October 30, 2026
5 min read
Intercom charges $0.99 per Fin AI outcome; Zendesk $1.50–$2.00 per automated resolution beyond the allowance, on top of $85–$115 per seat. Chatwoot is an open-source help desk, and answering from your own docs with a model on Bedrock is a few weeks of work. Where the per-resolution model gets expensive.
October 30, 2026
5 min read
Mailchimp prices by contact count, so a growing list costs more every month whether you email it or not. Listmonk is a self-hosted newsletter manager on PostgreSQL; Amazon SES sends at $0.10 per 1,000 emails. What you save, and the deliverability work you take on.
October 30, 2026
5 min read
Calendly is $10–$16 per seat per month; Cal.com is open source under MIT and can run in your own account. Scheduling is cheap either way, so the case for owning it is the data: who booked, when, and what they told you.
October 30, 2026
4 min read
Every vendor is adding AI, and the terms for what it reads, stores and trains on differ. Slack, for example, does not train generative models on customer data without opt-in, but uses it for predictive models unless you email to opt out. Ten questions to ask each vendor, and where owning the data changes the answers.
October 30, 2026
5 min read
ABA Formal Opinion 512 applies existing duties to generative AI: competence, confidentiality, communication, candour and reasonable fees. Informed client consent is needed before putting client information into tools that learn from it, and boilerplate engagement language is not enough. The options for firms, from business chat plans to a private assistant on AWS, and what each means for those duties.
October 26, 2026
7 min read
Corporate clients increasingly send outside counsel guidelines and security questionnaires before engaging a firm. The requests are predictable: MFA, encryption, incident notification, data return and destruction at matter end, vendor controls. The ethical baseline (Model Rule 1.6(c) and ABA Opinion 483), the common asks, and how mid-sized firms meet them without an enterprise security team.
October 26, 2026
5 min read
Retention is two opposite duties: keep what you must, delete what you should. S3 Object Lock gives you write-once storage with retention periods and legal holds that even administrators cannot bypass in compliance mode. How the modes work, how a legal hold differs from a retention period, and a design that keeps both duties straight.
October 26, 2026
5 min read
Tax preparers, many accounting firms, mortgage brokers and non-SEC-registered advisers are "financial institutions" under the FTC's Safeguards Rule. It requires a written information security program with nine elements, MFA for anyone accessing customer information, and since May 2024 a notice to the FTC within 30 days of a breach affecting 500 or more people. What is required and a practical setup for a small firm.
October 26, 2026
6 min read
The parts of accounting work that AI helps with today are clear: reading client documents, matching transactions, drafting explanations and searching past work. Judgment, sign-off and client advice stay with people. Where it pays off, the confidentiality rules to check first (including Section 7216 for tax return information), and how we would build it.
October 26, 2026
5 min read
Schools share student records with ed tech vendors under FERPA's school official exception, which puts the vendor under the school's direct control for that data. State laws such as California's SOPIPA and New York's Education Law 2-d add bans on targeted advertising and security requirements. What vendors sign, what they must build, and how to answer district security reviews.
October 26, 2026
5 min read
Black Friday is November 27 and Cyber Monday November 30. Most peak-day outages are not raw capacity: they are a quota nobody raised, a database connection limit, a third-party API that throttles, or a cache that was never warm. A four-week plan, the AWS limits worth checking, and what to freeze.
October 26, 2026
6 min read
Public companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining it is material, and describe their risk management and governance each year in the 10-K. The legal team owns the disclosure; engineering owns the facts it needs, fast. What those facts are and how to have them ready.
October 26, 2026
5 min read
Selling into healthcare, finance, insurance, education or government means security questionnaires: SIG, CAIQ, HECVAT, or the customer's own spreadsheet of 300 questions. The documents that answer most of them, the order to produce them in, and how to stop every deal waiting on the same answers.
October 26, 2026
5 min read
Signing AWS's Business Associate Addendum takes a few clicks in AWS Artifact. It covers only HIPAA-eligible services, and it leaves most of the Security Rule with you. What the October 2026 eligible list includes (Bedrock, AgentCore, HealthLake, HealthScribe), the split of responsibilities, and why we build to the proposed Security Rule even though it is not final.
October 26, 2026
6 min read
Consumer health apps that are not covered entities or business associates still fall under the FTC's Health Breach Notification Rule, amended in 2024 to name health apps and connected devices explicitly. A "breach" includes sharing data without authorization, such as through analytics and ad SDKs. Who is covered, the 60-day clock, penalties of up to $53,088 per violation, and what to check in your app.
October 26, 2026
5 min read
AWS HealthScribe turns a recorded patient visit into a transcript, structured notes and evidence links for $0.10 a minute, and it is HIPAA-eligible. Commercial scribe products add EHR integration, specialty templates and clinician workflow. The costs, the work that is not transcription, and when building makes sense.
October 26, 2026
5 min read
Cyber devices must include an SBOM, a vulnerability management plan and evidence of secure design in every premarket submission, and FDA's final guidance from June 2025 explains what reviewers expect. On February 2, 2026 the QMSR replaced the old Quality System Regulation with ISO 13485 by reference. What that means for software and cloud components running on AWS.
October 26, 2026
6 min read
Certified EHRs must support USCDI v3 from January 1, 2026, and SMART on FHIR lets an app launch inside the EHR with the clinician's context. The standards are the easy part. The integration types, what each can and cannot do, and why the calendar is set by your customer's IT team rather than your code.
October 26, 2026
5 min read
Cloud workstations put large models next to the compute, let contractors work without shipping hardware, and keep project data off laptops. They are not always cheaper than a workstation under a desk. How Amazon DCV and GPU instances work for Revit, Civil 3D, SolidWorks-class tools, the licensing questions to ask first, and where the cost crosses over.
October 26, 2026
6 min read
CFD, FEA and other solvers scale across many cores, which suits the cloud, but solver licences often cost more than the compute and decide the architecture. AWS Parallel Computing Service (managed Slurm), ParallelCluster and AWS Batch compared, what HPC instances and EFA add, and how to burst without paying for idle licences.
October 26, 2026
6 min read
Engineering firms sit on decades of specifications, RFIs, submittals, calculations and drawings that nobody can search well. Retrieval with a model on Bedrock makes them answerable, with citations. What it is good at, the licensing and client-data questions to settle first, and why the engineer of record stays responsible.
October 26, 2026
5 min read
Twenty-nine jurisdictions had adopted the NAIC's AI model bulletin by October 2026, Colorado replaced its general AI law in May 2026 while keeping its insurance-specific rules, and the EU moved high-risk obligations, including life and health insurance pricing, to December 2, 2027. What insurers using AI need to be able to show, and how to build it.
October 26, 2026
7 min read
First notice of loss forms, medical records, police reports, loss runs, invoices and supplemental applications arrive as PDFs, scans and photos. Three ways to turn them into data on AWS, with current per-page prices, the accuracy you should measure, and the human review loop that keeps it safe.
October 26, 2026
6 min read
A new MGA or insurtech needs quoting, binding, policy issuance, billing, endorsements, renewals and bordereaux from day one. SaaS policy platforms provide most of it; building gives control over the product and the experience. The tradeoffs, the parts nobody should build, and a hybrid that many teams end up with.
October 26, 2026
6 min read
Building fast skips the parts of the internet that only matter once people depend on you: DNS, certificates, email authentication, caching, timeouts, backups and abuse. What happens between someone typing your domain and your database answering, what breaks at each step, and the order we would fix things in.
October 26, 2026
4 min read
What each DNS record does, why you cannot put a CNAME on your bare domain, why DNS changes seem to take hours, and how to stop the domain itself becoming your single point of failure. With Route 53 prices and the January 2025 switch from WHOIS to RDAP.
October 26, 2026
7 min read
Gmail moved to rejecting non-compliant mail in November 2025, Outlook.com has sent non-compliant bulk mail to junk since May 2025, and DMARC became an IETF Proposed Standard in 2026 (RFC 9989). What the three records do, what each mailbox provider requires, and how to keep marketing from sinking your password resets.
October 26, 2026
7 min read
The CA/Browser Forum voted in April 2025 to cut maximum certificate lifetimes from 398 days to 200 (March 15, 2026), 100 (March 15, 2027) and 47 (March 15, 2029). ACM moved to 198-day certificates in February 2026 and Let's Encrypt is heading to 45 days. What TLS does, what the change breaks, and how to make expiry a non-event.
October 26, 2026
5 min read
Most slow apps are not slow because of code. They are slow because of distance multiplied by round trips: a database in a different region from the server, twenty sequential queries per page, a new connection per request. The arithmetic, and the fixes in order of payoff.
October 26, 2026
5 min read
Cache-Control decides what browsers and CDNs keep, for how long and for whom. Right, and most traffic never reaches your server. Wrong, and you either pay for every request or show one user's page to another. The directives that matter, four recipes, and what CloudFront charges when the cache misses.
October 26, 2026
6 min read
Every network call ends in success, failure or "we don't know". The third causes duplicate orders, double charges and stuck jobs. How status codes, timeouts, retries with backoff and idempotency keys fit together, with the limits on API Gateway and Lambda.
October 26, 2026
6 min read
Payment, auth and email providers tell your app what happened through webhooks. They arrive late, twice, out of order or not at all, and anyone can send a fake one. Using Stripe's documented behaviour as the example, the handler pattern that survives all of it.
October 26, 2026
5 min read
CORS is not a firewall, SameSite is not a complete CSRF defence, and a token in localStorage is not safer than a cookie, just exposed differently. What each browser mechanism does and does not do, and the cookie settings we would start with.
October 26, 2026
6 min read
Everything in a browser bundle or mobile app is public, including any variable your framework inlines at build time. Which keys are designed to be public and what actually protects you when they are, which must never ship, and what to do in the first hour after one leaks.
October 26, 2026
6 min read
Apps on Supabase, Firebase and similar platforms let the browser talk to the database directly. That is fine only if the database enforces who sees what, because anyone can call the same API without your UI. How row-level security works, the gaps that catch people (views, functions, storage), and a ten-minute test.
October 26, 2026
6 min read
Postgres gives every connection its own process and a fixed maximum, while serverless platforms create a new instance, and a new connection, for each concurrent request. The result is the classic launch-day error. How the limits are set on RDS and Supabase, what a pooler does, and the transaction-mode catch.
October 26, 2026
5 min read
A backup you have never restored is a hope. The two numbers that define a backup plan, which failures each kind of backup covers (including a compromised account and a bad migration), the RDS retention defaults that surprise people, and a quarterly restore drill that takes an afternoon.
October 26, 2026
5 min read
Attention brings traffic you did not want: credential stuffing, fake sign-ups, SMS fraud billed per message, scripts draining your AI budget, the occasional flood. What AWS and Cloudflare protect by default, what AWS WAF costs, and the limits we would add before the launch post.
October 26, 2026
6 min read
Each extra nine is ten times less downtime and usually far more than ten times the cost. Downtime budgets per month, why chaining services multiplies their failures, what an SLA actually promises, and the five checks a small team should have running.
October 26, 2026
5 min read
Internet-wide scanners probe every public IPv4 address continuously, so anything listening publicly gets found. Public and private addresses, the ports that matter, why databases and admin tools should not face the internet, what a public IPv4 address costs on AWS, and the replacement for open SSH.
October 26, 2026
5 min read
Token-by-token output makes AI features feel fast, and every proxy, load balancer and gateway between the model and the browser has a timeout that can cut it off. When to use Server-Sent Events, WebSockets or a background job, with current AWS limits: API Gateway REST streaming up to 15 minutes, WebSocket connections up to 2 hours, Lambda streaming up to 200 MB.
October 26, 2026
6 min read
Uploading through your API runs into payload limits (6 MB for synchronous Lambda, 10 MB for API Gateway), ties up servers and pays for the bytes twice. Letting the browser upload straight to S3 with a presigned URL avoids all three. How it works, enforcing size and type, scanning for malware, and serving files back privately.
October 26, 2026
5 min read
"Sign in with Google" is OpenID Connect; "let this app read my calendar" is OAuth. Access tokens, refresh tokens and ID tokens do different jobs, and mixing them up causes most auth bugs. The authorization code flow with PKCE, what each token is for, and the mistakes we see in fast-built apps.
October 26, 2026
6 min read
A passkey is a key pair: the private key stays on the user's device or in their password manager, and your server stores only the public key. Nothing to phish, nothing useful to steal from your database. How WebAuthn works, synced versus device-bound passkeys, account recovery, and a rollout that does not lock anyone out.
October 26, 2026
5 min read
Anything slow, flaky or bursty belongs off the request path: email, webhooks, AI calls, exports, image processing. Queues make that safe, provided your workers expect the same message twice. How SQS works, the settings that matter, and the failure modes of jobs built with setTimeout and cron.
October 26, 2026
6 min read
Observability does not need a platform team. Structured logs, a handful of metrics and traces on the main paths answer most "why is it broken?" questions. What each signal is for, OpenTelemetry as the default, CloudWatch prices that surprise people ($0.50 per GB of standard logs ingested), and an alert list short enough to respect.
October 26, 2026
6 min read
Most schema changes are safe; a few take locks that stop every query on a busy table. The expand-and-contract pattern for renames and type changes, the Postgres operations to treat with care (indexes, constraints, column rewrites), lock timeouts, and why the migration and the deploy must be separate steps.
October 26, 2026
6 min read
Every B2B app has to keep one customer's data from another's. Shared tables with a tenant ID are cheapest and the most common; separate databases or accounts per tenant are easier to explain to enterprise buyers. The models, where isolation is actually enforced, noisy neighbours, and when to move a big customer to its own silo.
October 26, 2026
6 min read
Reminders that fire an hour late twice a year, bookings that move when a user travels, reports that disagree about which day an order happened. Almost every date bug comes from losing either the instant or the user's time zone. The rules, the formats, and the cases where UTC alone is wrong.
October 26, 2026
5 min read
Rate limits protect your service from abuse, your bill from runaway clients, and your users from each other. The algorithms (fixed window, sliding window, token bucket), where to enforce limits (edge, gateway, application), what to key them on, and how to tell clients to back off properly.
October 26, 2026
5 min read
Some App Store and Play rules are really backend requirements: in-app account deletion that deletes associated data, revoking Sign in with Apple tokens, and keeping push tokens current. How push works through APNs and FCM, what account deletion must do server-side, and the backend pieces a mobile launch needs.
October 26, 2026
5 min read
GDPR applies to a US company that offers goods or services to people in the EU or monitors their behaviour, even with no office there. What that means in practice, the documents enterprise customers will ask for (a DPA, a subprocessor list, a transfer mechanism such as the EU-US Data Privacy Framework), and the engineering it implies.
October 26, 2026
6 min read
Most fast-built apps have one environment, or a staging that shares production's database. The minimum separation worth having, why separate AWS accounts beat naming conventions, preview environments per pull request, and how to test with realistic data without copying customers' personal information.
October 26, 2026
5 min read
Shipping often is safer than shipping rarely, if each change is small and easy to undo. How feature flags separate deploying code from releasing features, how canary and blue/green deploys limit the blast radius, and the rollback habits that make a bad deploy a five-minute event.
October 26, 2026
5 min read
The Amplify client libraries and UI components work against AWS resources created any way you like: CDK, Terraform or the console. How to point them at an existing Cognito user pool, AppSync API or S3 bucket, what you gain (sign-in screens, token refresh, signed uploads) and what you give up.
October 26, 2026
5 min read
Storage Browser for S3, an open-source component in the Amplify React and JavaScript libraries and generally available since December 2024, gives authorized users a file browser for S3: browse, search, upload, download, copy and delete, with checksums on upload. When it replaces a custom portal or an SFTP server, and how to scope access safely.
October 26, 2026
4 min read
A pre-certified ESP32 module makes certifying your product much easier, though it doesn't do it for you. What the FCC's modular approval actually covers, what the EU's RED cybersecurity rules have required since August 2025, how the Cyber Resilience Act takes over in December 2027, and a realistic path for a small hardware team.
October 26, 2026
9 min read
Espressif's range now spans dual-band Wi-Fi 6 with Thread on one chip, Thread-only parts for Matter networks and a 400 MHz media processor with no radio at all. Which chip fits which product, and the device-to-cloud design (identity, transport, updates) that keeps a fleet secure after it ships.
October 26, 2026
8 min read
Decisions teams on AWS should make before 2027, each with a deadline attached: model lifecycle and evaluation, agent identity, coding agents, container platforms, the EU's 2027 regulations, and the upgrades that get expensive if left until the summer.
October 26, 2026
8 min read
CRA vulnerability reporting has applied since September 11, 2026; its main obligations apply on December 11, 2027. AI Act high-risk obligations moved to December 2, 2027. A practical, engineering-side reading of what each means for software products and connected devices sold in the EU, and what to have in place a year early.
October 26, 2026
8 min read
If we were starting a product on AWS today and wanted it to still be sensible in 2027, these are the choices we'd make (compute, data, identity, AI, delivery and observability) with the reason for each and the condition that would change our mind.
October 26, 2026
7 min read
A visitor id, a session id and a page view id; a collector on our own domain; Firehose into S3; Athena with saved queries. How we built analytics that ad blockers do not drop, nobody else holds, and that costs less than a coffee at our traffic, and the three bugs we found on the way.
October 26, 2026
9 min read
The same analytics design works from a thousand events a day to billions: if you change the right piece at the right time. The four stages, what breaks at each, and when Iceberg, S3 Tables, Parquet and a warehouse start earning their cost.
October 26, 2026
8 min read
With a few thousand visitors a month, most A/B tests can only detect enormous differences, and most "winners" are noise. The arithmetic, what to test instead of button colours, how to count exposures properly, and the rules we use on our own site.
October 26, 2026
7 min read
ChatGPT, Perplexity, Claude and Gemini now send real visitors, and crawl your pages to answer questions without sending anyone. What your own analytics can see, what only Search Console and server logs can, why our own articles were invisible to AI crawlers until we fixed it, and a measurement setup that covers all three.
October 26, 2026
8 min read
Cognito spent two years fixing the reasons people left it: new Lite, Essentials and Plus tiers with managed login and passkeys, then in 2026 multi-Region replication, password-hash import, client-secret rotation, federation triggers, self-service rate limits and machine-to-machine tokens without a domain. What changed, what it costs, and whether to look again.
October 26, 2026
8 min read
When software acts for people, identity has to answer new questions: whose permissions does the agent carry, who approved this action, and how does your API tell a real agent from an impersonator? The patterns that work (on-behalf-of tokens, asynchronous approval with CIBA, Cross App Access, MCP's OAuth model and signed agent traffic) and what to build first.
October 26, 2026
9 min read
In 2026 Cloudflare sits in front of more identity decisions than most identity products: who reaches internal apps, which bots reach your sign-up form, which AI agents reach your site and which MCP servers your staff's agents may use. What each product does, and how it combines with Cognito, Auth0 or Okta behind it.
October 26, 2026
7 min read
Passkeys are now supported by every major platform and can move between password managers. How to roll them out without locking anyone out: enrolment prompts, recovery, the relying-party ID you must choose correctly the first time, and what Cognito, Auth0 and the rest do for you.
October 26, 2026
7 min read
Moving from Auth0, Firebase, a home-grown system or anything else to Cognito or another provider: bulk import with password hashes (Cognito accepts bcrypt, scrypt, Argon2id and PBKDF2 since July 2026), lazy migration at sign-in, what cannot move, and a cut-over plan with a way back.
October 26, 2026
7 min read
DataStore gave Amplify apps local storage with automatic sync and conflict resolution. Gen 2 has no equivalent, and Gen 1 reaches end of life on May 1, 2027. Which apps actually need offline-first, and the three realistic paths: Amplify Data online with local caching, Apollo clients with AppSync, or a different sync engine.
October 25, 2026
5 min read
Amplify Hosting added skew protection, WAF, SSR compute roles, configurable build instances and Node.js 24 since 2025. What it costs (builds, storage, transfer at $0.15 per GB, SSR compute), what it does well, and the signs it is time to run CloudFront yourself.
October 25, 2026
6 min read
Amplify Gen 2 compiles TypeScript resource definitions into AWS CDK, so anything it does not model can be added as CDK in the same backend, and it can deploy from your own CI with ampx pipeline-deploy. When that is enough, and the signs a team should move the backend to a plain CDK app.
October 25, 2026
5 min read
The AI kit, generally available since November 2024, adds conversation and generation routes to an Amplify Gen 2 backend and a ready-made streaming chat component. Underneath: AppSync, a Lambda that calls Bedrock's Converse API, and DynamoDB for per-user history. What it gives you, what it costs, and when to build the same thing yourself.
October 25, 2026
5 min read
Amplify Auth is Amazon Cognito with a TypeScript definition and client libraries. Since November 2024 it supports passwordless sign-in with SMS and email codes and passkeys, and Gen 2 supports OIDC and SAML sign-in with Entra ID, Okta and Auth0. The setup, the limits (no MFA and passwordless for the same user) and the costs.
October 25, 2026
5 min read
Every modernization plan starts with the same question: what do we actually run? A one-week method for servers, databases, applications and the scheduled jobs and integrations nobody listed, using tools that are current in 2026 (Application Discovery Service and Migration Hub are now in maintenance).
October 25, 2026
6 min read
Extended support and ESU charges that start or double in 2027, licence changes from Power BI to Fabric, the cost of the January 2027 Microsoft cluster, and the labour to avoid all of it. A worksheet of the line items to price, with the published rates we have checked this year.
October 25, 2026
6 min read
Announced October 1, 2026, the Well-Architected Agent analyzes live accounts and Terraform, CDK and CloudFormation against the Well-Architected pillars and proposes fixes, including runbooks and IaC changes. It needs an AWS Support plan. What it is good at, what it cannot know, and how we use it alongside a review.
October 25, 2026
5 min read
Java 8 to 17, Python and Node.js runtime bumps, AWS SDK v1 to v2, framework upgrades: the same change repeated across hundreds of repositories. AWS Transform custom (December 2025) runs these as defined transformations from one CLI command; coding agents such as Claude Code and Codex handle one-off and judgment-heavy changes. When to use which, and how to keep both safe.
October 25, 2026
6 min read
ECS runs Windows containers on EC2 and on Fargate, which is the fastest way to get .NET Framework apps off hand-managed Windows servers. Porting to modern .NET on Linux takes longer and removes the Windows licence. The cost, the effort and the gotchas of each.
October 25, 2026
5 min read
The Jenkins server under someone's desk is a classic legacy system: plugins nobody updates, credentials in global config, builds only one person can fix. GitHub Actions Importer audits Jenkins, forecasts Actions usage and converts pipelines. What converts cleanly, what does not, and how to handle AWS credentials on the other side.
October 25, 2026
5 min read
Many products still run as a docker-compose file on one server, or a small Swarm cluster. It works until the server needs patching, the disk fills or traffic doubles. How the pieces of a compose file map to ECS, where state should go, and how ECS Express Mode and ECS Gateway make the move small.
October 25, 2026
5 min read
The file server is often the last thing in the server room. Four places its contents can go, depending on whether they are team documents, application shares, or archives: FSx for Windows File Server, FSx for NetApp ONTAP, SharePoint and OneDrive, or S3. How to split the share, and what each costs to run.
October 25, 2026
6 min read
Old servers survive because something on them runs at 2 a.m. Finding every Windows Task Scheduler job, SQL Server Agent job and crontab entry, and moving them to EventBridge Scheduler with Lambda, ECS tasks or Step Functions, with retries, alerts and an audit trail they never had.
October 25, 2026
5 min read
Microsoft owns both, and new investment goes mostly to GitHub, but Azure DevOps is supported and still the better fit for some teams. Boards, Test Plans, pipelines and security compared, Azure DevOps's $6 Basic plan versus GitHub's per-user plans and per-committer security add-ons, and how to move without losing history.
October 25, 2026
5 min read
Power Apps Premium is $20 a user a month and extra Dataverse database storage is $48 per GB a month. A small custom app on AWS costs more to build and very little per user. How to compare the two over three years, and the signs an app has outgrown low-code, or never needed custom code.
October 25, 2026
6 min read
AL2027 entered public preview in September 2026 with kernel 7.1, SELinux enforcing by default, post-quantum key exchange on by default, DNF5, Python 3.14, GCC 16 and AWS-LC alongside OpenSSL 3.5. The changes most likely to break your builds and AMIs, and a sensible way to test before it is generally available.
October 25, 2026
6 min read
Since September 30, 2026, Aurora PostgreSQL 17 and 18 can query Apache Iceberg and Parquet in S3, S3 Tables and Glue-catalogued lakes in the same SQL as live operational data, using an embedded DuckDB engine. No extra charge. What it is good for, its limits, and when you still want Redshift or Athena.
October 25, 2026
6 min read
Bedrock now runs OpenAI's agent harness and frontier models as a managed service inside AWS: IAM permissions, CloudTrail audit, data kept in AWS, with AgentCore Runtime as the default compute. How it relates to AgentCore, the OpenAI Agents SDK and Claude-based agents, and what preview means for production plans.
October 25, 2026
5 min read
In twelve months Lambda grew from one compute model to five. Event Functions (the classic model, renamed), Web Functions for HTTP servers billed on active CPU, Durable Functions for long workflows, MicroVMs for isolated sandboxes, and Managed Instances on EC2. What each is for and how each bills.
October 25, 2026
7 min read
Launched in October 2026, Web Functions run a normal HTTP server on Lambda: no adapter, many concurrent requests per environment, native streaming, and billing on requests, active vCPU and held memory. AWS's worked examples, how it compares with Event Functions and function URLs, and what to check before moving.
October 25, 2026
6 min read
CloudWatch Omni, generally available since September 23, 2026, reorganizes CloudWatch around teams and applications, adds a dedicated experience for observing AI agents, built on OpenTelemetry, and investigations in natural language. What it covers, where it runs, and how it changes the case for a third-party APM.
October 25, 2026
5 min read
Launched October 20, 2026, ECS Gateway lets a platform team define ingress once and lets services attach to it: up to 25 services share an ALB, each gets its own hostname and ACM certificate, and the gateway adds or removes load balancers as needed. No extra charge beyond the ALBs. What it does, what it does not, and how it fits with Service Connect.
October 25, 2026
6 min read
AWS App Mesh reached its discontinuation date on September 30, 2026. AWS points ECS users to Service Connect (no extra charge, now zone-aware) and offers VPC Lattice for cross-account traffic; EKS users often land on Istio. What each replaces, what each does not, and how to migrate.
October 25, 2026
6 min read
A practical map from Azure services to AWS equivalents (App Service, Functions, AKS, Azure SQL, Cosmos DB, Service Bus, Key Vault, Azure OpenAI), what usually stays on Microsoft (Entra ID, Microsoft 365, Power BI), how egress is handled, and a migration order that avoids running two half-finished platforms.
October 25, 2026
8 min read
Old instance families cost the same or more than current ones and deliver less. A current Graviton instance is usually 15–20% cheaper at list price than the Intel generation many fleets still run, before any performance gain. What moves easily, what does not, and how to do it without a big-bang migration.
October 25, 2026
6 min read
SQL Server Integration Services packages run a lot of nightly data movement. On AWS you can keep them on RDS for SQL Server with the SSIS option, run them on EC2 or RDS Custom, or rebuild them as Glue jobs orchestrated by Step Functions. The limits of each, and how to choose per package.
October 25, 2026
6 min read
Drupal 7 reached end of life on January 5, 2025, and Magento 1 in 2020. WordPress 7.0 now requires PHP 7.4, which itself has been end-of-life since 2022. How to tell which upgrade path is realistic (in place, rebuild, or replace), and how to host the result on AWS without inheriting the same problem.
October 25, 2026
6 min read
Dynamics CRM 2016 reached end of support on January 13, 2026, and on-premises Dynamics 365 Customer Engagement 9.x leaves mainstream support on January 12, 2027. How to choose the next CRM, and why the plugins, integrations and reports built around the old one decide the timeline.
October 25, 2026
6 min read
Team Foundation Server 2017 reaches end of support on January 11, 2027, and Azure DevOps Server 2020 left mainstream support in October 2025. How to move source control from TFVC to Git, pipelines from XAML or classic builds to YAML or GitHub Actions, and work items to a supported system.
October 25, 2026
6 min read
Starting with SQL Server 2025, Microsoft consolidates on-premises reporting into Power BI Report Server and will release no new versions of SQL Server Reporting Services. What that means for estates full of RDL reports, the licensing, and when it makes sense to move reporting off SQL Server entirely.
October 25, 2026
6 min read
Microsoft has not retired Azure Synapse dedicated SQL pools, but it points every new warehouse at Fabric and ships a migration assistant for Synapse. When moving to Fabric makes sense, when staying is fine, and when a company whose applications are on AWS should move the warehouse there instead.
October 25, 2026
6 min read
Amazon Corretto keeps Java 8 patched until December 2030 and Java 11 until January 2032, so the deadline is not the JDK. It is everything around it: Spring Boot 2, javax packages, old Lambda runtimes and the libraries that stopped supporting Java 8 years ago. What the upgrade involves and the order we do it in.
October 25, 2026
6 min read
Every company has one: an Access database on a file share, a macro-heavy spreadsheet or a VB6 desktop app that a critical process depends on. Why they are risky, how to replace them without breaking the people who rely on them, and when a low-code tool beats a custom build.
October 25, 2026
6 min read
BizTalk Server 2016 and Host Integration Server 2016 end support on January 11, 2027. BizTalk 2020 is the last release, with extended support until April 2030. How BizTalk's pieces (orchestrations, adapters, maps, EDI, BAM) map to AWS services, and a migration order that does not stop the business.
October 25, 2026
7 min read
Bedrock can now constrain generation to a JSON Schema, so a response that violates the schema cannot be produced. What it supports, what it does not (recursion, numeric and string constraints), the first-call latency, and how it changes extraction pipelines and agents.
October 25, 2026
6 min read
Google's spam policies do not ban AI-written content. They ban many pages made mainly to rank, by any method. What scaled content abuse, site reputation abuse and expired domain abuse cover, and the process we use to publish a lot without publishing junk.
October 25, 2026
6 min read
AWS Activate now offers up to $200,000 for provider-backed startups, Google up to $350,000 for AI startups, Microsoft up to $150,000. What each requires, what the credits cover (including Claude and OpenAI models on Bedrock), the AWS Free Tier changes, and how not to let credits choose your cloud for the wrong reasons.
October 25, 2026
6 min read
Most LLM systems that work in production are workflows with a model in a few steps, not open-ended agents. The five workflow patterns, when a real agent loop earns its cost, and how to tell which one a problem needs before building either.
October 25, 2026
7 min read
An agent that can refund, delete, email customers or change infrastructure needs a person in the loop for the risky steps. How to build approval gates that wait hours or days without paying for compute, with durable function callbacks, signed approval links, timeouts that default to no, and an audit trail.
October 25, 2026
7 min read
No prompt or classifier reliably stops prompt injection. What does work is architecture: limiting what an agent can reach, keeping private data, untrusted content and outbound channels apart, and putting approvals on side effects. A practical checklist mapped to the OWASP Top 10 for LLM Applications.
October 25, 2026
7 min read
Model retirements now force a migration every year or so, and every prompt change is a release. A small, honest eval set turns both into a day of work instead of a month of guessing. How to build one from real traffic, how to grade it, and what to automate.
October 25, 2026
7 min read
CloudWatch is a top-five line on many AWS bills, and most of it is log ingestion nobody reads. What changed (Lambda logs moved to tiered vended pricing, logs gained intelligent storage tiering in July 2026) and the levers that cut the bill without losing what you need in an incident.
October 25, 2026
7 min read
Data transfer is the AWS cost people understand least, because it is spread across a dozen line items. Every hop a byte can take (same AZ, cross-AZ, cross-Region, internet, NAT, Transit Gateway, PrivateLink, CloudFront) with US East prices and the architecture patterns that quietly multiply them.
October 25, 2026
7 min read
Landing zone 4.0 made almost everything in Control Tower optional: Config, CloudTrail, security roles, Backup, even the Security OU. You can now use its 750-plus managed controls without a landing zone at all. What changed, what to enable, and when Control Tower is the wrong tool.
October 25, 2026
9 min read
Karpenter went from v1.0 to v1.15 in two years: static capacity, NodeOverlay for pricing and capacity overrides, NodePool node limits, a grace period for do-not-disrupt, a Balanced consolidation policy, CapacityBuffer and DRA for GPUs. What each is for, a production NodePool, and the case for letting EKS Auto Mode run it.
October 25, 2026
9 min read
Four controls that look similar and do different jobs. SCPs cap what your principals can do, RCPs cap what can be done to your resources by anyone, declarative policies pin service settings, and centralized root access removes root credentials from member accounts. Which to use for what.
October 25, 2026
7 min read
Security Hub relaunched at the end of 2025 as one console over GuardDuty, Inspector, Macie and what is now called Security Hub CSPM, with exposure findings and per-resource pricing that includes Inspector scanning. How the bill works and a sensible order for turning things on.
October 25, 2026
6 min read
Amazon EVS runs VMware Cloud Foundation inside your VPC on bare-metal EC2, with your own Broadcom licences. Rehosting with AWS Application Migration Service drops VMware entirely. Modernizing takes longest and saves most. The cost, speed and risk of each.
October 25, 2026
6 min read
Terraform is IBM's now, OpenTofu has shipped features Terraform does not have, CDK for Terraform is archived, HCP Terraform's free tier is capped at 500 resources, and AWS CDK gained Mixins. What changed, what each tool costs, and how we choose.
October 25, 2026
9 min read
Lambda can now checkpoint, suspend for up to a year and resume where it left off, in ordinary Python, TypeScript or Java. That puts a third option between Step Functions and Temporal. How each one models a workflow, what each costs, and which kind of team each suits.
October 25, 2026
8 min read
Lambda Managed Instances runs your functions on EC2 instances in your account, many requests per environment, at EC2 prices plus a 15% fee. It removes cold starts and opens Savings Plans to Lambda, and it gives up scale-to-zero. Where it fits between standard Lambda and Fargate.
October 25, 2026
7 min read
AWS's regional NAT gateway simplifies multi-AZ networking but costs the same per hour. The savings are elsewhere: free gateway endpoints for S3 and DynamoDB, ECR pulls kept off NAT, public IPv4 addresses at $3.65 a month each, and IPv6 egress that has no hourly charge.
October 25, 2026
7 min read
Database Savings Plans cover Aurora, RDS, DynamoDB, ElastiCache and more with one hourly commitment, up to 35% off, on a one-year term with no upfront payment. RIs still discount more for workloads that will not change. How to choose, and how to avoid buying both for the same database.
October 25, 2026
6 min read
Claude Code talks to Amazon Bedrock with one setting, and Codex has been on Bedrock since June 2026. How to set either up for a whole team (SSO, pinned models, prompt caching, guardrails, per-team costs) and the mistakes that make the bill or the security review go badly.
October 25, 2026
8 min read
AgentCore went generally available in October 2025 and kept growing: Runtime, Gateway, Identity, Memory, Observability, Policy, harness, payments. What each does, which problems it solves that your framework does not, and a sensible order to adopt them.
October 25, 2026
7 min read
The Model Context Protocol made connecting agents to tools easy, which is exactly the problem. The risks that matter in production (tool output as an injection channel, over-broad tokens, unreviewed servers) and how Gateway, Identity and Policy on AgentCore, or your own controls, contain them.
October 25, 2026
7 min read
Most LLM bills can fall by half without touching quality. The five levers on Amazon Bedrock in 2026: prompt caching (now with a 1-hour TTL), 50%-off batch inference, Flex and Priority tiers, reasoning effort, and routing each task to the smallest model that passes your evals.
October 25, 2026
7 min read
Claude Sonnet 5.5 and GPT-6 Astra both take a million tokens of input. So why build a retrieval pipeline at all? When stuffing the context wins, when retrieval still wins, and the hybrid most production systems end up with.
October 25, 2026
6 min read
AI makes producing articles nearly free, which is why the web is filling with confident, outdated, wrong ones. The pipeline behind this site: primary sources first, claims checked before drafting, dates on everything, a human who knows the subject, and analytics to tell whether it helped anyone.
October 25, 2026
6 min read
Redis relicensed and came back, Vault went BSL, MinIO stopped maintaining its community edition, and AWS kept adding managed versions of the open-source tools. How to decide service by service, with the licence changes that matter and twelve head-to-head comparisons.
October 25, 2026
8 min read
ECS added blue/green and canary deployments, managed EC2 and one-call deploys; EKS made Kubernetes far easier to operate, but kept charging six times as much for clusters that fall behind. What actually decides it now, with the numbers.
October 25, 2026
8 min read
Control plane, extended support, Auto Mode fees, EKS Capabilities, provisioned control-plane tiers, Hybrid Nodes, and the line that never appears on an invoice. A worked example for a small team and how to keep each number down.
October 25, 2026
7 min read
Amazon ECS now deploys blue/green with test traffic and a rollback window, and linear and canary with CloudWatch alarm rollback, on ALB, NLB and VPC Lattice, at no extra charge. How each works, the Lambda hooks, and when CodeDeploy still earns its place.
October 25, 2026
6 min read
Teams are moving from self-run Kubernetes to ECS, mostly because nobody wants to own the cluster. How to tell whether you should, what maps to what, and a service-by-service migration that never needs a freeze.
October 25, 2026
7 min read
Kubernetes 1.31 clusters are auto-upgraded after November 26, 2026; 1.34 leaves standard support on December 2. Every EKS date from now to the end of 2027, what happens on each, and an upgrade routine that fits in a sprint.
October 25, 2026
6 min read
OpenAI's models have run on Amazon Bedrock since June 2026, so the platform decision is no longer about which models you can use. What it is about now (data handling, identity, lifecycle and lock-in) and a short plan for teams that built on OpenAI directly.
October 25, 2026
7 min read
Two unauthenticated remote-code-execution flaws in PHP 8.2–8.5, exploited in the wild before they were disclosed. The fixed versions, what to do on Elastic Beanstalk, Lambda, Lightsail and containers, and why the config workarounds circulating are not enough.
October 24, 2026
9 min read
Ten fixes across Node.js 22, 24 and 26, including a Brotli decompression bug that can lead to remote code execution and two ways to slip past TLS hostname checks. Who is actually exposed, the versions to move to, and what that means for Lambda, ECS, EKS and Beanstalk.
October 24, 2026
8 min read
On October 21, 2026 two critical PHP flaws were disclosed after being exploited for four days, Node.js shipped ten security fixes, and LiteLLM, the gateway holding many companies' AI API keys, published a release with a credential stealer inside. What that day teaches about how fast "fast" now has to be.
October 24, 2026
7 min read
Most AWS accounts can cut 30–60% of their bill. The approach we use to find the savings and keep them.
March 10, 2025
9 min read
A data lakehouse combines the scale of a data lake with the query performance and governance of a warehouse. The AWS services we use to run one in production, and how they fit together.
February 10, 2025
14 min read
The AWS controls that actually matter for SOC 2 Type II, and the ones that are pure checkbox theater. Based on real audit experience.
February 3, 2025
10 min read
These decisions seem fine at 10 users. At 10,000, they're production incidents, security risks, or five-figure monthly bills.
January 28, 2025
8 min read
The account structure you set up in your first week on AWS follows you for years. What a sound foundation includes, and the order to set it up.
January 15, 2025
6 min read
Kubernetes has a large attack surface. The checklist we work through before any EKS cluster goes to production.
January 8, 2025
9 min read
The tenant isolation model you choose early shapes security, operations and cost for years. Pool, silo and bridge models compared, and how to choose.
December 18, 2024
11 min read
SQS, SNS, EventBridge and Kinesis overlap, and teams often pick the wrong one. What each is for, and how to choose.
December 10, 2024
10 min read
Cold starts are real. But they're often blamed for performance problems they didn't cause, and fixed with solutions that create bigger problems.
November 20, 2024
8 min read
Glue, EMR and Athena overlap on the surface. What each is good at, what each costs, and how to choose.
November 12, 2024
8 min read
Most AWS IAM setups are either too permissive or so tight they block engineers. How we get to least privilege without slowing anyone down.
October 30, 2024
9 min read
Want to talk through a specific problem?
These posts cover common questions — but every situation is different.
Get in touch