All posts
AWS Architecture

Platform Engineering in 2027: The AWS Stack We Would Choose Today, and Why

By

October 26, 2026

7 min read

If we were starting a product on AWS today and wanted it to still be sensible in 2027, these are the choices we'd make (compute, data, identity, AI, delivery and observability) with the reason for each and the condition that would change our mind.

2027
Platform Engineering
AWS
Architecture
Opinion

This is opinion, informed by the client work we do and the changes AWS shipped in 2025 and 2026. Each choice comes with the condition that would make us choose differently, which is the part worth arguing about.

Layer

Our default

We would choose differently if…

Accounts

AWS Organizations with Control Tower, separate accounts per environment

Never — this is the foundation everything else assumes

Infrastructure as code

AWS CDK in TypeScript

The team already runs Terraform or OpenTofu well

Compute

ECS on Fargate; Managed Instances for GPUs and steady load; Lambda for events

We depend on Kubernetes operators or must run outside AWS — then EKS Auto Mode

Database

Aurora PostgreSQL or RDS PostgreSQL on a current major version

Access patterns are pure key-value at scale — then DynamoDB

Cache

ElastiCache Serverless for Valkey

Traffic is steady and large — then node-based with reservations

Events

EventBridge, SQS and SNS

High-volume streams with replay — then MSK Express

Analytics

Firehose into S3 with Athena, Iceberg when volume demands

Many teams need real-time — then a stream in front

Identity (customers)

Cognito Essentials, or WorkOS for B2B

Identity is core to the product — then a library like Better Auth in our own database

Identity (agents)

OAuth resource server per the MCP spec; AgentCore Identity for our own agents

Enterprise customers require Cross App Access — then add it

AI

Bedrock, models chosen per task on our own evaluation sets, behind one client

A model we need is only available directly from its provider

Delivery

GitHub Actions with OIDC; native ECS canary deployments

Kubernetes — then Argo CD as an EKS Capability

Observability

OpenTelemetry everywhere; CloudWatch, plus an LLM tracing tool

Metrics volume makes CloudWatch expensive — then Managed Prometheus

Edge

CloudFront with WAF, every page prerendered

Traffic already terminates at Cloudflare

Want a second opinion on this for your system?

Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.

The principles under the table

  • Prefer managed services where the work is undifferentiated, and own the parts that are your product.

  • Choose things with published lifecycles, and put the dates on a calendar.

  • Keep the expensive-to-change decisions — data models, user IDs, event schemas — your own, so every vendor choice above stays reversible.

  • Make every model, runtime and provider replaceable by configuration, and test the replacement before you need it.

hoolco Monthly Review

Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.

As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.