SECTION — JOURNAL 102 ENTRIES

The full archive

The journal

Building in the AI-native era — where cloud meets coding assistants and agentic AI.

SERIES — ONGOING

See all →

AI & LLM Fundamentals Cloud Security AWS Architecture Agentic AI

SECTIONS — BY DOMAIN

All AI AI Engineering Cloud Security Weekly Digest

SECTION — CLOUD · 34 ENTRIES

CLOUD

25 September 2026 · 6 MIN READ

AWS This Week: EventBridge's New Event Bus, Network Security Manager and Cross-Continent DynamoDB (Video)

80 seconds on the AWS news that changes how platform teams build this week: Amazon EventBridge relaunches the custom event bus (one bus for the whole organisation, ordered delivery, per-GB pricing), AWS Network Security Manager is generally available, DynamoDB multi-Region strong consistency now crosses continents, Kinesis Data Streams picks the partition key for you — plus one industry signal: Seller Central opens to outside AI agents.

Read → †❖ #AWS

CLOUD

23 September 2026 · 5 MIN READ

AWS This Week: CloudWatch Omni, GPT-6 Sol & Luna and Claude Opus 5.5 on Bedrock (Video)

88 seconds on the AWS news that actually changes your AI platform this week: Amazon CloudWatch Omni is generally available (observability organised around teams and applications, with an evaluation workflow for agents), OpenAI's GPT-6 Sol and Luna reach GA on Amazon Bedrock, Claude Opus 5.5 lands on AWS — plus one industry signal: frontier model prices fell twice in one day.

Read → #AWS

CLOUD

21 September 2026 · 3 MIN READ

AWS This Week: Flat-Rate Direct Connect, PrivateLink Tunnels and 2-Second Agent Cold Starts (Video)

79 seconds on the AWS news that actually changes your architecture this week: PrivateLink Tunnel Endpoints, Direct Connect flat-rate pricing for dedicated connections, the new AgentCore Runtime with snapshot-restored cold starts, EC2 T8i burstable instances — plus one industry signal: Claude Code adopts AGENTS.md.

Read → ❖ #AWS

CLOUD

16 September 2026 · 9 MIN READ

Build a Live Audience Voting Game for Your Conference Talk in a Weekend (Serverless, Zero Paid Tools)

For a conference session I co-delivered, I wanted a hundred-plus people swiping live votes on their phones — without Mentimeter, without Kahoot, and without a single credential in the JavaScript bundle. The whole backend is three DynamoDB tables behind an IAM-authenticated AppSync API: a singleton GameState row drives lobby, launch, reveal and podium; Cognito guest identities sign every call with SigV4; votes are namespaced by runId so a reset hides everything without deleting anything. Total AWS bill for the event: under a dollar.

Read → ❖ #Serverless

CLOUD

08 September 2026 · 3 MIN READ

Deep Dive: The AWS AI Security Framework in 85 Seconds (Video)

80% of organizations have adopted AI — only 10% govern it. AWS just published the AI Security Framework: the right controls, at the right layers, at the right phases. An 85-second explainer plus the architect's takeaway: day-1 controls are configuration changes, not architecture changes.

Read → † #AWS

CLOUD

07 September 2026 · 2 MIN READ

AWS This Week: 4 Launches That Matter for Your Architecture (Video)

76 seconds on the AWS news that actually changes your architecture this week: Claude Fable 5.1 on Bedrock, Amazon Quick GA, Bedrock Knowledge Bases 3LO connectors for SharePoint/Confluence, EC2 AMI instance-type enforcement — plus one industry signal on agentic commerce.

Read → ❖ #AWS

CLOUD

05 September 2026 · 1 MIN READ

AWS This Week: 4 Launches That Matter for Your Architecture (Video)

68 seconds on the AWS news that actually changes your architecture this week: Lambda SnapStart for container images, AgentCore-generated architecture diagrams, Amazon Linux 2027 preview, CloudFront flat-rate pricing API — plus one industry signal on offensive AI.

Read → ❖ #AWS

CLOUD

05 September 2026 · 2 MIN READ

Field Notes: Your Public Certificates Are About to Expire 5x Faster (Video)

Public TLS certificate validity is collapsing — 200 days today, 100 in 2027, 47 by 2029. A 90-second field note on migrating a certificate fleet to ACM: the easy 90%, the two traps (vendor CA allowlists, off-AWS endpoints), and the pattern that avoids a scheduled outage.

Read → † #AWS

CLOUD

05 September 2026 · 4 MIN READ

Lambda SnapStart Now Covers Container Images: The Last Cold-Start Excuse Is Gone

AWS extended Lambda SnapStart to container image functions — up to 10 GB, sub-second resume, nearly all commercial Regions. Here's what it unlocks for ML inference and heavy runtimes, the snapshot discipline that still applies, and how it changes the SnapStart vs provisioned concurrency vs Fargate math.

Read → ❖ #AWS

CLOUD

06 August 2026 · 8 MIN READ

Bedrock Cuts GPT-5.6 Prices by up to 80%: What the Luna/Terra/Sol Asymmetry Tells You

AWS just cut GPT-5.6 Luna prices by 80% and Terra by 20% on Bedrock, matching OpenAI's first-party cut on the same day. The interesting part is not the discount — it's the asymmetry, and what it changes in your model-routing math. With worked examples.

Read → #AWS

CLOUD

23 July 2026 · 5 MIN READ

AWS + Cerebras: wafer-scale inference is coming to Bedrock

AWS is deploying Cerebras CS-3 systems in its data centers, pairing Trainium for prefill with the Wafer Scale Engine 3 for decode. Why disaggregated inference is the right architecture, and what makes a 4-trillion-transistor chip the right tool for the decode problem.

Read → ∴ #AWS

CLOUD

20 July 2026 · 10 MIN READ

Attributing Bedrock Costs per User and per Project: 4 Mechanisms That Actually Work

The claim that you can't tag Bedrock calls is partly true and mostly misleading. Here are the four cost attribution mechanisms, when to use each, and the gateway pattern that unlocks per-user dollars in your bill.

Read → #AWS

CLOUD

20 July 2026 · 9 MIN READ

Loom + FAST: Wiring an Enterprise Agent Control Plane to a Customer-Facing App on AgentCore

AWS quietly shipped two open-source answers to two different agent problems. I deployed both, wired them together, then tried to break the architecture. Here is what holds, what doesn't, and the pattern for letting customers 'create agents' without losing governance.

Read → ⁂ #AWS

CLOUD

10 July 2026 · 9 MIN READ

AWS Transform + GenAI for VM Migration: The Assisted Data-Center Exit

A grounded look at what agentic AI actually accelerates in a large VMware migration, where AWS Transform earns its keep, and where a human still owns the decision.

Read → #AWS

CLOUD

10 July 2026 · 11 MIN READ

Building a Modernization Index from CUR Data: A CUDOS / Athena / QuickSight Guide

Every leadership team eventually asks how modern is our AWS estate? Here is how to answer it with one honest number, computed from Cost and Usage Report data, and how to avoid turning it into a vanity metric.

Read → #AWS

CLOUD

04 June 2026 · 20 MIN READ

Multi-PKI on a Single CloudHSM Cluster — Why KMS Is the Wrong Tool for Certificate Authorities

AWS KMS can technically sign with asymmetric keys, but it speaks REST — not PKCS#11. For PKI workloads that need HSM-backed signing, key export, and multi-tenant isolation, CloudHSM's Crypto User model gives you partition-equivalent isolation without legacy constraints.

Read → † #AWS

CLOUD

30 May 2026 · 10 MIN READ

Amazon Leo for Enterprise: What a LEO Satellite Network Changes for Cloud Architecture

Amazon Leo Ultra delivers 1 Gbps via satellite with private networking to AWS. Here is what it concretely changes for enterprise connectivity, how it integrates with Cloud WAN and Direct Connect, and when it beats MPLS, SD-WAN, or Starlink.

Read → ❖ #AWS

CLOUD

24 April 2026 · 7 MIN READ

Linux Package Management in AWS China Regions — RHUI, Squid Proxies, and What EPEL Cannot Do

You have RHEL 9 instances in AWS China regions managed via SSM. Installing PostgreSQL 17 or EPEL packages means opening dozens of dynamic URLs through China's restricted network. Here is what actually works in production.

Read → #AWS

CLOUD

23 April 2026 · 8 MIN READ

The Cloud Trust Scorecard — 8 KPIs to Bridge the CIO-CFO Gap on Cloud Value

Your CFO asks 'is our cloud well-run?' You need one dashboard, eight numbers, and zero jargon. Here is the framework: 4 money KPIs + 4 risk KPIs = Trust. With specific formulas, targets, and what to explicitly exclude.

Read → † #FinOps

CLOUD

10 April 2026 · 6 MIN READ

Overlapping CIDRs in Cross-Account Kubernetes Migrations — Why PrivateLink Resource Endpoints Change Everything

You are migrating microservices between Kubernetes clusters across AWS accounts, but the source uses /16 CIDRs that collide with corporate. The 2022 playbook (Private NAT Gateway + NLB per service) is obsolete. Here is what re:Invent 2024 gave us.

Read → ❖ #AWS

CLOUD

09 April 2026 · 6 MIN READ

Cloud WAN vs Transit Gateway — 3 Things It Actually Adds, 5 Things It Does Not

Cloud WAN promises centralized global networking. At a 30 percent premium over Transit Gateway, what do you actually get, and what are the common misconceptions? Here is the honest technical and financial analysis.

Read → ❖ #AWS

CLOUD

05 April 2026 · 6 MIN READ

AWS Weekly Digest — Week 14, 2026: AI Scholars, Agent Plugin for Serverless, Aurora Express, and Lambda Upgrades

Weekly roundup of AWS announcements: AI Scholars program, Agent Plugin for serverless, Aurora Express setup, Lambda upgrades, Polly streaming, and more.

Read → ❖ #AWS

CLOUD

17 March 2026 · 10 MIN READ

Your ZTNA Strategy Has a Blind Spot — External Users Need a Different Approach

AWS Verified Access is a strong ZTNA solution for internal users, but it breaks down for external contractors and partners on unmanaged devices. Here's a hybrid architecture that closes the gap with AppStream 2.0.

Read → † #AWS

CLOUD

16 March 2026 · 10 MIN READ

Why Amazon Connect Is an AI Platform That Happens to Handle Phone Calls

How Amazon Connect's native AI stack replaces fragmented CCaaS platforms with a unified, pay-per-use contact center backbone for global enterprises.

Read → #AWS

CLOUD

16 March 2026 · 9 MIN READ

Your CSPM Won't Save You — Why Cloud Security Is a Governance Problem

Enterprise teams invest in best-of-breed CSPM tools and still face critical IAM incidents. The gap isn't tooling — it's security governance. Here's how native AWS services fill it.

Read → † #AWS

CLOUD

12 March 2026 · 12 MIN READ

Securing Active Directory on AWS: A Practical Guide to AD Tiering with ANSSI and AWS SRA Alignment

How to map the ANSSI AD tiering model onto AWS, why Managed AD may not be enough for Tier 0, and which AWS security services close the compliance gaps.

Read → † #AWS

CLOUD

07 March 2026 · 5 MIN READ

HTTPS on AWS Lightsail: Setting Up Let's Encrypt with Apache and Route 53

Step-by-step guide to configuring a custom subdomain with Route 53 and securing an AWS Lightsail instance with a free TLS certificate using Let's Encrypt and Certbot.

Read → † #AWS

CLOUD

07 March 2026 · 9 MIN READ

Migrating a Large Public-Certificate Estate to AWS ACM Exportable Certificates

A practical guide to replacing a third-party CA with ACM exportable public certificates — covering pricing, automation patterns, industry validity changes, and the gotchas nobody mentions.

Read → †❖ #AWS

CLOUD

05 March 2026 · 14 MIN READ

When Your Keys Get Locked In: Navigating AWS KMS Import Limitations

AWS KMS doesn't allow key material export by design. When an external PKI partner generates keys but doesn't retain them, you're stuck. Here are the four AWS alternatives — CloudHSM, XKS, Private CA, and fixing the process — with a decision framework to pick the right one.

Read → † #AWS

CLOUD

26 February 2026 · 11 MIN READ

MPLS vs SD-WAN vs CloudWAN: Enterprise Networking Explained Simply

A visual, jargon-free guide comparing MPLS, SD-WAN, and AWS CloudWAN for enterprise networking — with analogies, comparison tables, and an architecture diagram showing how the three layers connect.

Read → ❖ #AWS

CLOUD

22 February 2026 · 7 MIN READ

AWS Weekly Roundup — February 2026: AgentCore, Bedrock, EC2 and More

A curated summary of the most important AWS announcements from February 2026 — from Bedrock AgentCore deep dives to new EC2 instances and the European Sovereign Cloud.

Read → ❖ #AWS

CLOUD

22 February 2026 · 14 MIN READ

Deploying a Personal AI Assistant on AWS with Bedrock AgentCore Runtime

A hands-on walkthrough of deploying OpenClaw on AWS using AgentCore Runtime for serverless agent execution, Graviton ARM instances, and multi-model Bedrock access — from CloudFormation template to customizing the agent's personality.

Read → #AWS

CLOUD

13 February 2026 · 10 MIN READ

Replacing Legacy SFTP with AWS Transfer Family in a Multi-Account Landing Zone

How to architect a secure, multi-tenant SFTP service across AWS accounts using Transfer Family, NLB, Transit Gateway, and per-partner S3 isolation.

Read → †❖ #AWS

CLOUD

26 January 2026 · 4 MIN READ

AWS Backup Cost Analysis

EBS snapshot costs were growing month-over-month with no clear explanation or optimization strategy.

Read → #AWS