Insights

AWS & Kubernetes notes from the control plane.

Notes on EKS networking, federal cloud compliance, declarative Terraform, and modern observability, written from the trenches of production infrastructure.

Featured Article

Email Notifications for GuardDuty Findings: The Why and the How

2026-09-09 · 9 min read

Email Notifications for GuardDuty Findings: The Why and the How

GuardDuty finds the intrusion and then tells nobody. Why the console is a dead end, and how to route high-severity findings to email using EventBridge and SNS.

Amazon GuardDutyEventBridgeAmazon SNSAWS Security

Read Article →

All Articles

Distributed Load Testing on EKS with k6 Operator

2026-08-24 · 7 min read

Distributed Load Testing on EKS with k6 Operator

One k6 process caps out around a few thousand VUs before it becomes its own bottleneck. k6 Operator splits a test across a cluster instead.

Why Your Website Needs an SSL Certificate, and When Free Is Not Enough

2026-07-29 · 9 min read

Why Your Website Needs an SSL Certificate, and When Free Is Not Enough

Chrome has labelled plain HTTP pages "Not secure" since 2018, and HTTP/2, HTTP/3, service workers, and the camera API all refuse to run without TLS. This post covers what HTTP actually leaks, how DV, OV, and EV differ, the mixed-content and HSTS traps that break half-migrated sites, and the four cases where a paid certificate beats Let's Encrypt.

Send Alertmanager Email Through SES With an IAM Role, No SMTP Passwords

2026-07-15 · 7 min read

Send Alertmanager Email Through SES With an IAM Role, No SMTP Passwords

Amazon SES is the cheapest way to email your Alertmanager notifications. The catch: its SMTP interface wants a static username and password. If your alerting stack already runs on EC2, ECS, or EKS, it has an IAM role sitting right there. aws-ses-relay lets Alertmanager speak plain SMTP and forwards through the SES API using that role, so there is no SMTP password and no AWS secret key anywhere in your config.

Why terraform init Downloads the Same Provider 40 Times — and How to Stop It

2026-07-10 · 7 min read

Why terraform init Downloads the Same Provider 40 Times — and How to Stop It

Every terraform init in every working directory downloads its own private copy of the AWS provider — half a gigabyte, over and over. One environment variable turns that into a single shared copy on disk. Here's how the plugin cache directory works, what it actually saves, and the one gotcha that bites people in CI.

AWS Lambda MicroVMs: VM Isolation Meets Serverless State

2026-06-22 · 9 min read

AWS Lambda MicroVMs: VM Isolation Meets Serverless State

AWS Lambda MicroVMs went GA on June 22, 2026, giving each user or session a Firecracker-backed sandbox that can suspend and resume for up to 8 hours instead of cold-booting every time. Here's how the build/launch flow works and where it actually fits.

AWS IaC Generator: Turn Plain English into Reviewed, Policy-Checked Terraform

2026-06-22 · 9 min read

AWS IaC Generator: Turn Plain English into Reviewed, Policy-Checked Terraform

Describing infrastructure is easy; writing correct, secure Terraform for it is not. AWS IaC Generator is a Go pipeline that turns a plain-English requirement into validated, Trivy-scanned Terraform — through a six-stage pipeline that never deploys a single resource.

driftlens: Detect Drift Across All Your Terraform Modules at Once

2026-06-16 · 8 min read

driftlens: Detect Drift Across All Your Terraform Modules at Once

Terraform drift is insidious. A manual change here, a console click there, and your state file quietly lies about what's running. driftlens scans every module in your repo in parallel, runs plan, and tells you exactly what has drifted before it causes an incident.

Enforcing AWS Tagging Standards with Terraform Tag Policies

2026-06-12 · 9 min read

Enforcing AWS Tagging Standards with Terraform Tag Policies

Untagged AWS resources are a silent cost and governance nightmare. Here's how to lock down tagging standards across your entire AWS organization using Tag Policies and Terraform — from defining the policy to making terraform plan fail if a tag is missing.

AWS FinOps Agent Is in Public Preview — and It Changes Who Owns Cloud Cost

2026-06-11 · 8 min read

AWS FinOps Agent Is in Public Preview — and It Changes Who Owns Cloud Cost

AWS just put its FinOps Agent into public preview — an agentic AI that investigates cost spikes, answers 'why did my bill go up?' in plain English, and routes the answer straight to the engineer who caused it. Here's what it actually does, how the loop works, and where it fits before you turn it on.

AWS Interconnect is Now GA: Multicloud & Last-Mile Private Connectivity Done Right

2026-05-17 · 9 min read

AWS Interconnect is Now GA: Multicloud & Last-Mile Private Connectivity Done Right

AWS Interconnect is now generally available — bringing fully managed private connectivity between AWS and other clouds, plus simplified last-mile access from branch offices and data centers. Here's a complete breakdown of what changed, how it works, and when you should use it.

Native Claude Platform on AWS: Why This is a Huge Deal for Enterprise AI

2026-05-13 · 5 min read

Native Claude Platform on AWS: Why This is a Huge Deal for Enterprise AI

AWS announced the availability of Claude Platform on AWS. Here is why getting native Anthropic features through your cloud bill is a game changer.

Beyond Zonal Silos: Why AWS Regional NAT Gateway is a Massive Win for Architects

2026-05-12 · 6 min read

Beyond Zonal Silos: Why AWS Regional NAT Gateway is a Massive Win for Architects

AWS finally launched Regional NAT Gateways, eliminating the need for per-AZ setups and public subnets in sensitive VPCs. Here is why it changes everything.

vCluster on EKS with Karpenter: Dev & QA Environments in Under 5 Minutes

2026-04-28 · 12 min read

vCluster on EKS with Karpenter: Dev & QA Environments in Under 5 Minutes

Running a dedicated EKS cluster per environment is slow and expensive. Learn how vCluster on a shared EKS host cluster with Karpenter autoscaling lets you provision fully isolated dev and QA environments in under 5 minutes at up to 70% lower cost.

Introducing Amazon S3 Files: The First 'Honest' S3 File System

2026-04-17 · 6 min read

Introducing Amazon S3 Files: The First 'Honest' S3 File System

Amazon S3 Files provides a high-performing full file system semantics layer for S3, bridging the gap between object storage and traditional compute needs.

Beyond Chatbots: How Moltbot (ClawdBot) is Redefining Personal Automation

2026-01-28 · 5 min read

Beyond Chatbots: How Moltbot (ClawdBot) is Redefining Personal Automation

Moltbot (formerly ClawdBot) is leading the shift from passive chatbots to proactive agents that function as personal AI employees.

Rapid K8s Deployment in Local with Tilt

2025-08-06 · 8 min read

Rapid K8s Deployment in Local with Tilt

Transform your microservices development experience with Tilt - the tool that reduces development cycle time from minutes to seconds while maintaining production parity.

AWS Chatbot is now Amazon Q Developer, and I'm not happy about it

2025-05-07 · 5 min read

AWS Chatbot is now Amazon Q Developer, and I'm not happy about it

AWS has renamed AWS Chatbot to Amazon Q Developer, raising concerns about clarity and functionality for users.

Evolve Your Backup Validation Strategy Now

2025-05-07 · 6 min read

Evolve Your Backup Validation Strategy Now

Learn why backup validation is critical and how to evolve your strategy to ensure reliable data recovery.

Introducing Amazon CloudFront SaaS Manager: Simplifying Multi-Tenant Web Delivery at Scale

2025-05-07 · 5 min read

Introducing Amazon CloudFront SaaS Manager: Simplifying Multi-Tenant Web Delivery at Scale

Amazon CloudFront SaaS Manager provides a template-based approach for managing multi-tenant environments at scale, simplifying content delivery for SaaS platforms.

AWS EKS Auto Mode: A Game-Changer or Just Hype?

2025-05-07 · 7 min read

AWS EKS Auto Mode: A Game-Changer or Just Hype?

AWS EKS Auto Mode promises to make Kubernetes cluster management as simple as a single click. But is it truly a game-changer, or just more AWS hype?