Posts

AI/ML: Search and Recommendations (Kendra, Personalize)

Console-first guide to Amazon Kendra and Amazon Personalize. AWS CLI in collapsible sections.

AI/ML: Speech, Vision, and Documents (Polly, Transcribe, Rekognition, Textract)

Console-first guide to Polly, Transcribe, Rekognition, and Textract. AWS CLI in collapsible sections.

AI/ML: Text and Chatbots (Comprehend, Translate, Lex)

Console-first guide to Amazon Comprehend, Translate, and Lex V2. AWS CLI commands in collapsible sections.

API Gateway Mapping Templates for DynamoDB

Velocity Template Language (VTL) examples for API Gateway proxy integrations with DynamoDB-PutItem, GetItem, and custom JSON responses.

API Gateway WebSocket APIs

WebSocket route keys ($connect, $disconnect, $default), MOCK integration setup, CLI inspection commands, and Lambda handler patterns for custom routes.

API Gateway with Amazon Cognito

Runbook for securing REST and HTTP APIs with Cognito User Pools (JWT authorizer) and Identity Pools (IAM/SigV4), including OAuth grants, trust policies, and scopes.

API Gateway: Cognito and Lambda authorizers, binary uploads, canary, and cache

REST API with Cognito and Lambda authorizers, binary media types to S3, stage canary with cache, CORS on proxy routes, and forwarding all traffic to a load balancer.

AppConfig - production console guide

Hosted configuration and feature flags - applications, environments, deployment strategies, and safe rollouts for live systems.

AppConfig: Freeform Configuration

Daily playbook: Freeform profile, JSON Schema validators, hosted versions, deployment (release) with bake-time rollback.

AppSync GraphQL Task Manager

Cognito-authenticated AppSync GraphQL API with DynamoDB, JavaScript resolvers, user-scoped task access, and Admins group authorization.

AppSync Real-Time Collaboration

Multi-user project tasks with Cognito auth, DynamoDB single-table design, pipeline resolvers with membership checks, and GraphQL subscriptions for live updates.

AppSync Ticket API: Multi-Auth and EventBridge

Support ticket API with Cognito and IAM auth, Lambda-backed createTicket, DynamoDB pipeline for updateTicketStatus, and EventBridge event publishing.

Architecture Reference Links

Curated Well-Architected, prescriptive guidance, workshops, and hands-on lab templates for EKS, networking, and data.

Batch in the current console

Current AWS Batch: wizard, Fargate and EC2 environments, fair-share scheduling, consumable resources, job definitions, and the console settings that are not resources.

Batch on Fargate: Quick Start Guide

Step-by-step setup for AWS Batch with Fargate-IAM, security groups, ECR job image, compute environment, queue, submit job, pitfalls.

Bedrock AgentCore in Production

Part 4 — AgentCore Build console (Harness, Runtime, Gateways, Memory, Policy, Identity), IAM roles, and Lambda/compute integration for production agents.

Bedrock AgentCore: Step-by-Step with Lambda and EC2 (Instances)

Deploy an agent on AgentCore Runtime (microVM or EC2 Instances), invoke it from Lambda or the AWS CLI, and clean up sessions—console and CLI walkthrough aligned with current AWS docs.

Build an AWS VPC with CloudFormation

Deploy a lab VPC with public and private subnets using CloudFormation.

Building with Amazon Nova

Bedrock Nova inference with Converse, InvokeModel, streaming, tools, multimodal inputs, and structured JSON.

Centralized Egress with Transit Gateway and Network Firewall

Inspect spoke internet traffic in a dedicated inspection VPC, then NAT out from an egress VPC. CloudFormation order, TGW association vs propagation, appliance mode, and the templates in dir/vpc/egress-firewall.

Checklist: AppConfig Schema and S3 Bucket Hygiene

Short checklist: AppConfig JSON schema, S3 lifecycle / CRR / versioning / tags.

CI/CD: CodePipeline, CodeBuild, and CodeDeploy

Quick-reference patterns for CodePipeline, CodeBuild, and CodeDeploy setups.

Cloud cost optimization (console)

Tags, budgets, anomaly detection, Compute Optimizer, S3 lifecycle, and the charges competitions expect you to notice: NAT, data transfer, idle disks.

Cloud Design Patterns in Plain English

AWS Prescriptive Guidance modernization patterns, explained simply, with official diagrams.

Cloud roles mapped to real AWS work

How Cloud Architect, DevOps, Cloud Developer, and Cloud Security map to console work: architecture, migration, cost, cloud-native apps, and security.

CloudFront with Multiple Origins: Path Routing, Failover, and Origin Selection

One CloudFront distribution in front of S3, ALB, and API origins. Cache behavior order, origin groups, OAC, VPC origins, and CloudFront Functions origin selection, with console and CLI steps.

CloudWatch agent on EC2, step by step

Install the current CloudWatch agent on EC2, publish memory and disk metrics, and confirm them in the CWAgent namespace. Console and SSM.

CodePipeline full-system console guide

Build a multi-stage CI/CD pipeline in the console - source, CodeBuild, approvals, ECS/EKS deploy, artifacts, KMS, and cross-service IAM.

Cognito and Keycloak Federation

Keycloak on EKS with RDS PostgreSQL, Cognito OIDC federation, and how app pods validate Cognito JWTs.

Data Services: RDS, Redshift, and Athena

Operational runbooks for Amazon RDS day-2 checks, Redshift COPY loads from S3, and Athena tables for VPC Flow Logs forensics.

Databases on AWS - networking, security, backup (console)

RDS and Aurora production placement - subnet groups, security groups, encryption, backups, IAM auth, and hybrid access patterns.

Deploy an Application on EKS with ALB and Autoscaling

ECR push, eksctl cluster, Deployment, HPA, Cluster Autoscaler, AWS Load Balancer Controller, and ALB Ingress.

Deploy, Operate, and Integrate Amazon Bedrock

Production Bedrock patterns—Agents, IAM, Lambda, API Gateway, S3, DynamoDB, OpenSearch, and EventBridge.

Docker: Alpine Non-Root Images and ECR

DocumentDB: TLS in Transit and Connecting with the CA Bundle

Enable and verify TLS to DocumentDB using global-bundle.pem—mongosh, Python, and Node examples, cluster parameters, CA rotation, and console checklist.

DynamoDB Accelerator (DAX): Use and Integrate

Swap the DynamoDB client for a DAX client: cluster in a VPC, IAM, Lambda packaging, item vs query cache, write-through, and when to call DynamoDB directly for strong reads.

ECR Best Practices

Repository hardening workloads-scan on push, immutable production tags, and lifecycle policies for cost control.

ECR lifecycle and repository policies - console guide

Production ECR - immutable tags, scanning, lifecycle expiration rules, and cross-account pull policies via the console.

ECR: Repository Settings and Lifecycle Policy

Scan on push, tag mutability, resource tags, and a lifecycle policy that expires untagged, branch, and excess production images - with prefix rules split (ECR matches all prefixes on a rule).

ECS and Lambda CI/CD with CodePipeline

BuildSpec, AppSpec, and task definition patterns for ECS blue/green deployments and Lambda pipelines with Amazon ECR.

ECS at production scale: Service Connect, Service Discovery, and storage

Deep guide to ECS east-west networking (Service Connect vs Cloud Map discovery) and production filesystem choices—console walkthroughs, failure modes, and when to use EBS, EFS, FSx, and S3 Files.

ECS service autoscaling from SQS queue depth

Scale an ECS service on messages waiting in SQS: backlog per task, Container Insights, step scaling to zero, and the capacity provider underneath.

ECS Service Connect vs Cloud Map Service Discovery

When to use Service Connect vs Cloud Map, wiring, and common failure modes on ECS.

Egress-Only IPv6 with VPC and Transit Gateway

Notes on egress-only VPC routing with AWS Transit Gateway.

EKS ALB Ingress with AWS Load Balancer Controller

Expose services on EKS via the AWS Load Balancer Controller and ALB Ingress.

EKS Cluster Autoscaler and Karpenter

When pods are pending, who adds nodes: Cluster Autoscaler on managed node groups versus Karpenter NodePools. IAM, tags, interruption queue, and how not to run both on the same capacity.

EKS Cluster Operations Runbook

EKS version guidance, access entries, Pod Identity vs IRSA, and day-2 cluster operations for Amazon EKS.

EKS GitOps: CodeCommit to Argo CD

End-to-end GitOps from CodeCommit through CodePipeline to Argo CD on EKS.

EKS Ingress with VPC Lattice - console guide

Expose Kubernetes services through VPC Lattice - service networks, associations, Gateway API, and how this differs from ALB Ingress alone.

EKS Kubernetes Resource YAML Examples

Minimal YAML samples for common Kubernetes resources on EKS.

EKS Storage: EBS, EFS, and S3

Daily playbook for persistent storage on Amazon EKS: pick EBS vs EFS vs S3, install CSI add-ons, copy-paste StorageClass/PVC/PV, and avoid common bind and permission failures.

EKS with Keycloak - production console walkthrough

Run Keycloak on EKS for OIDC - console and cluster steps, ALB ingress, database, HA, and integration with apps and Cognito federation.

EKS with Kyverno - console-oriented production guide

Policy-as-code on EKS - install verification, representative ClusterPolicies, and governance patterns beyond the Helm install steps.

EKS Workloads Quick Reference

EKS Notes

ElastiCache for Valkey: Lambda Caching Pattern

Cache-aside with Lambda, ElastiCache for Valkey, and DynamoDB - VPC setup, TLS client, TTL keys, invalidation, and advanced caching patterns.

Embeddings and RAG with Amazon Nova

Vector embeddings, knowledge bases, and retrieval-augmented generation on Amazon Bedrock.

ETL in Brief: Glue, DMS, EMR, and When to Use Each

A concise map of extract-transform-load on AWS: service choices, DocumentDB-to-lake patterns, Glue workflows, and ELT vs ETL.

ETL with Glue, crawlers, Kinesis, Firehose, and Lambda

Northwind Retail clickstream: Kinesis Data Streams, Firehose, Lambda transform, S3, Glue crawler, and Glue ETL job. Console steps, IAM, and mistakes.

EventBridge Integration Patterns

EventBridge rules, event patterns, input transformers, archive/replay, pipes, scheduler, and DLQs.

Fraud detection with DynamoDB Streams and AgentCore Harness

Scenario: DynamoDB stream triggers Lambda, Lambda invokes a fraud orchestrator harness that calls four specialist agents via Gateway, then persists results to DynamoDB.

Getting Started with Amazon EKS

Initial EKS cluster setup including IAM roles, nodes, CNI, and ECR.

Hidden AWS settings competitions actually score

Console checkboxes and small services that decide a full-system build: encryption, IMDSv2, deletion protection, private DNS, DLQs, backups, and logging.

IAM Policies: Examples and Triage Guide

Copy-paste trust, identity, resource, boundary, SCP, session, and VPC endpoint policies with a rapid troubleshooting checklist.

IAM Policy Conditions Reference

Common IAM policy condition keys and copy-paste examples for S3 encryption, date/time, tags, IP, MFA, region, and other scenarios.

IAM Roles, Policies, and VPC Endpoints

Identity and resource-based IAM policies, cross-account AssumeRole, sts:AssumeRole allow/deny patterns, and VPC endpoint policies for S3 and DynamoDB.

Import a Private Certificate into ACM

OpenSSL CA + self-signed cert, import into ACM, and optional Mountpoint for S3 on the host.

Install Argo CD on Amazon EKS

Install Argo CD on EKS, expose the server with a LoadBalancer, retrieve the admin password, and log in from the CLI.

Install Karpenter on Amazon EKS

Install Karpenter on an existing EKS cluster for node autoscaling.

Install Kyverno on Amazon EKS

Install and configure Kyverno policy engine on Amazon EKS.

IoT Core: MQTT, Policies, and Rules Engine

Thing, X.509 cert, policy, MQTT publish/subscribe, rules to Lambda, shadows, and common connect/policy failures.

Kinesis Data Streams and Analytics

Reference videos and AWS resources for Kinesis Data Streams, producer/consumer patterns, and Kinesis Data Analytics.

Kubernetes and AWS CLI Snippets

Quick-reference kubectl, eksctl, ECR, FSx, EBS, and VPC Flow Logs commands for EKS day-2 operations.

Lab Notes: EventBridge, RDS, Backup, and JAM

Lab notes and medium-to-hard Jam troubleshooting: IAM, delivery, and VPC edge associations on internet and virtual private gateways.

Lambda and RDS: IAM Database Authentication

EventBridge, SQS, DynamoDB, and RDS event pipeline patterns.

Lambda CI/CD with CodePipeline and CodeDeploy

End-to-end Lambda deployment pipeline using CodeCommit, CodeBuild, CodePipeline, and CodeDeploy canary traffic shifting.

Lambda Event-Driven Pipeline Patterns

EventBridge, SQS, DynamoDB, and RDS event pipeline patterns.

Lambda Python Runtime and Packaging

Python Lambda handler patterns, deployment packages, virtual environments, layers, and packaging notes for boto3 and third-party dependencies.

llama.cpp: Local GGUF Inference

Run GGUF models locally with llama-server, download from Hugging Face, estimate VRAM and RAM needs, and pick a quantization for your hardware.

Migrate servers, databases, and files (console)

Northwind lift-and-shift: Application Migration Service, DMS for MySQL, and DataSync for a file share. Cutover, test, and settings people skip.

Monitoring with Grafana and Prometheus

Set up Grafana and Prometheus on EKS with CloudWatch observability.

Network Firewall for Centralized Egress

Rule groups, policies, endpoints, stateless vs stateful processing, domain lists, Suricata, TLS inspection, managed rules, and logging - with the centralized TGW lab as the multi-VPC pattern.

Networking Overview

Runbook for Network Firewall, Transit Gateway hub-and-spoke, VPC Lattice, and centralized inspection routing patterns.

OrderFlow: CLI and Operations Snippets

Copy-paste EKS, IRSA, RDS, SQS, ingress, and add-on commands for the OrderFlow migration project.

OrderFlow: Migrate Workloads to Amazon EKS

Phase-by-phase migration from in-cluster PostgreSQL to RDS, Secrets Manager, SQS, SNS, and DynamoDB on Amazon EKS.

Prometheus Alerts with SNS and SQS

Wire Prometheus Alertmanager to SNS and SQS on EKS.

Prometheus on EKS with EBS CSI Storage

Run Prometheus on EKS with persistent volumes via the AWS EBS CSI driver.

Run Workloads on AWS Fargate with Amazon EKS

Quick start for EKS Fargate profiles-pod execution role, private subnets, eksctl, sample Deployment, networking pitfalls.

S3 encryption with KMS - console, policies, and access

SSE-KMS on S3 buckets - default encryption, bucket policies, KMS key policies, and decryption paths for apps and analytics.

Sealed Secret on Amazon EKS

Use Sealed Secret on Amazon EKS.

Search CloudWatch Logs

Current ways to search CloudWatch Logs: log group filter, Logs Insights, OpenSearch SQL and PPL, Live Tail, field indexes, and saved queries.

Security implementation patterns (console)

Organization guardrails, KMS, logging, detective controls, and network isolation - patterns commonly combined in production and system-design exercises.

Serverless on AWS with AWS SAM

11-phase walkthrough building an event-driven order pipeline with SAM, Lambda, HTTP API, EventBridge, SQS, and DynamoDB.

Serverless SAM and CLI Snippets

SAM build, deploy, local invoke, scaling policy, and CodeDeploy commands for the serverless order-events project.

Service Best Practices

Operational and security best practices by AWS service—S3 versioning and lifecycle, IAM least privilege, RDS backups, EKS logging, and more.

ShopFlow on ECS: end-to-end production walkthrough

Build ShopFlow—a four-service Fargate storefront on ECS with Service Connect, Cloud Map discovery for settlement Lambda, EFS audit storage, ALB ingress, and production IAM and deployment order.

ShopSphere on Amazon EKS (End-to-End Walkthrough)

Complete microservices lab on EKS-VPC, Flask backend, ALB ingress patterns, autoscaling, Prometheus, Grafana, GitOps, and secrets.

Site-to-Site VPN on AWS (console guide)

Production-oriented Site-to-Site VPN - VGW and Transit Gateway paths, routing, security, and commonly missed console settings.

SQS and SNS with KMS encryption and IAM

Console and policy patterns for encrypted SNS topics and SQS queues - key policies, subscriptions, and cross-service permissions teams miss.

SSH, SCP, cp, and AWS CLI commands

Copy files to EC2 and S3, then the AWS CLI checks used to review S3, EC2, security groups, RDS, EBS, CloudTrail, and IAM.

System design and DevOps prep checklist

Industry-level AWS topics for full-system implementations - commonly missed items, service combinations, and links to console-focused reference posts on this site.

Use existing AI services (console, no model training)

Northwind invoices: S3 to Textract and Comprehend via Lambda. Architect pattern for managed AI, IAM, KMS, and what not to build in SageMaker.

Verified Permissions with Cognito and API Gateway

Group-based API access with Amazon Verified Permissions, Cognito User Pool groups, Cedar policies, and API Gateway authorizers.

VPC Lattice Application Networking

Order-management lab: ECS then service network, Lattice services, security groups, EKS in VPC-A, EC2/Lambda, and RDS/private resources via resource configurations.

VPC Lattice on EKS with Gateway API

Install AWS Gateway API Controller, service network association, Gateway + HTTPRoute + TargetGroupPolicy for VPC Lattice.

VPC Lattice on EKS with Gateway API (updated)

lab-cluster walkthrough: Pod Identity + Helm serviceAccount.create=true, Gateway name = service network, two Python apps, Route 53 private zone, HTTPRoute troubleshooting.

VPC Lattice Path-Based Routing Lab

Hands-on VPC Lattice setup with EC2 and Lambda backends, target groups, path-based routing, weighted default action, and service network VPC association.

VPC peering (console guide)

When to use VPC peering, console steps, routing and DNS, and non-transitive routing traps for multi-VPC system designs.

VPC Transit Gateway (Reference Links)

VPC Transit Gateway

What Is a vCPU on Amazon EC2?

How virtual CPUs map to physical cores on Intel, AMD, and Graviton instances-and how vCPU limits affect EC2 capacity.