field notes
Technical essays organized around commercial problems, each one links to a service, a case study, and a next step if the pattern matches your stack.
Ship features that survive real tenants, real traffic, and the first compliance review, not just the demo.
2 articlesInfrastructure you can change without dreading the next apply, state layout, module boundaries, and safe promotion.
3 articlesKnow when you're down before customers do, health checks, alarms, SLOs, and recovery paths you've tested.
2 articlesMatch spend to workload shape, right-sizing, scale-to-zero, and structural changes that show up on the bill.
1 articleIsolation, access boundaries, and audit trails that survive a security review, not just application-level filters.
1 articleDeploy paths you trust on Friday, OIDC credentials, immutable artifacts, smoke tests, and rollback you have exercised.
1 articleOne AWS account feels simpler until dev and prod share a blast radius. Management account hygiene, organizational units, member accounts, and SCPs, in the order you should adopt them.
Most ECS Terraform starters skip the choices that matter. Private tasks, per-environment sleep, alarms that page, and OIDC deploys, encoded so production cannot inherit the wrong default.
AWS already emits metrics and logs. The gap is routing the right signals to a human. Metrics, alarms, logs, and canaries, in the order you should build them.
A shared S3 bucket does not have to mean shared access. Use one Access Point per tenant to keep permissions small, changes isolated, and data boundaries clear.
Non-production environments do not need to run overnight. Schedule them to zero and back on a timer, and cut idle spend without touching production.
Prompt injection is the top LLM risk. Layer input sanitization, output validation, and least-privilege tools so untrusted text cannot steer your model.
Stop storing AWS access keys in GitHub. Use OpenID Connect so your workflow assumes a role and gets short-lived credentials scoped to your repo.
What 98% uptime really means, and the AWS building blocks that get you there. Managed multi-AZ services, health checks, alarms, and a recovery plan you have tested.
Cut Lambda cold starts across a large serverless backend. Shrink the artifact, pick a fast runtime, keep init lean, and use provisioned concurrency last.
Serve a static Next.js export from a private S3 bucket behind CloudFront. You get HTTPS, edge caching, and a Lambda API on one domain for close to nothing.