https://lckhd.eu/WKuFBW Transit Gateway handles the heavy lifting for multi-account AWS networking, but it's Layer 3 including IP routing, CIDR management, and security groups. VPC Lattice operates at Layer 7 and introduces IAM-based auth, meaning you can define policies like "only this role can

https://lckhd.eu/tfBt4s Modern DevOps has moved past storing AWS keys in pipelines. This article walks through a cleaner approach. Using GitHub Actions authenticating via OIDC, Terraform managing the full stack, and cert-manager handling TLS automatically. The setup covers VPC, EKS, ECR, and ALB

https://lckhd.eu/DeO2nb I've run into exactly this kind of problem before and the rather cryptic errors. A cluster autoscaled from 11 to 33 nodes, the subnets showed 600+ free IPs, and yet pods were stuck failing with "failed to assign an IP address to container." In the example below, the culprit

https://lckhd.eu/NoPSSl Using containers on AWS without having to pay for a control plane (like with EKS) makes it easy to run workloads with variable uptimes.

https://lckhd.eu/zRDsDo Using managed and serverless services on AWS can be highly scalable and save time for almost no cost in many cases. Taking advantage of services like Cloudtrail which monitors all changes in your AWS and SNS for notifications can keep you up on any important changes.

https://lckhd.eu/OfpWPa Its great to decouple as much as possible in your architecture but debugging distributed systems has always been challenging.

https://lckhd.eu/NkMeMy There are multiple options on AWS for running containers but my go to default approach is with the Elastic Container Service (ECS). AWS doesn’t charge to run the ECS control plane and it’s easier to setup than Kubernetes. With ECS you can use EC2 instances for worker nodes

https://lckhd.eu/SMyWrT I recently wrote an article about using S3 Files. For nearly two decades, "S3 as a file system" has meant download to /tmp, process, upload, and a copy-then-delete dance to fake a rename.

https://lckhd.eu/gPyU3U Setting up a Kubernetes cluster manually on EC2 with kubeadm is one of the better ways to understand what managed services like EKS are actually doing for you.

https://lckhd.eu/wrbykB There have been so many tools to choose from when setting up a Python project over the years. You have pyenv for versions, venv for isolation, pip to install, Poetry or pip-tools to lock things down.

https://lckhd.eu/7Z13gO Observability has typically been an afterthought for many deployments but it is key, and that is no different with agents. Slow responses and memory that keeps growing are important to understand, but they don't always get noticed on the backend. With things like this,

https://lckhd.eu/bZffRx A standard Kubernetes Deployment only checks that new pods pass their probes. It has no idea whether the new version is returning errors to real users. This kind of gap in the case of a bad update could quietly cause you big issues. Probes are not correctness. Argo

https://lckhd.eu/mUu6fU Using EC2 Spot instances on AWS is a great way to save money on compute but it's not always as simple or cheap as you may expect. There are pricing quirks and capacity gaps that can cause some issues and it's worth understanding these before you start using Spot in

Next week I'm heading to my first AWS Heroes Summit in Seattle. Meeting many of the Heroes at re:Invent last year was amazing. Hanging out in person beats a Zoom call every time and I'm looking forward to spending quality time and getting to know everyone better.

https://lckhd.eu/Ddb2td If you run Kubernetes on-prem, pulling every image from Docker Hub isn't always the right call. Restricted connectivity, security policies, or a simple preference to keep artifacts inside your own infrastructure all point toward hosting a registry yourself. The article

https://lckhd.eu/ZRCljw Converting PDFs to audio in another language typically involves multiple manual steps. Managed and serverless services make it easy to build apps like this one including chaining Textract, Translate, and Polly into an event-driven pipeline where you upload a PDF and get

https://lckhd.eu/qawf7M ECS is a reasonable place to start with containers on AWS, though the vocabulary can be confusing. Clusters, task definitions, tasks and services sound similar enough that it isn't clear to many what they are all for.. This article attempts to make it more clear. Some of

https://lckhd.eu/qnMeU7 I have spent a lot of time in my life installing (and updating) the AWS CLI everywhere in my environments and there are not that many steps but reducing it to 1 is a nice QOL improvement.

https://lckhd.eu/zpNKCz Managing secrets across different hosting environments can be an operational challenge, especially as infrastructure grows more complex. One cross-platform approach involves using HashiCorp Vault. Steps to do this covering installation, server setup, unsealing, and working

https://lckhd.eu/S3E8mO The AWS DevOps Agent is an interesting solution as an AI assistant for incident investigation. Most of what I've seen published on it focuses on what it does rather than how you actually set it up. I like to always use Infrastructure as Code (IaC) with Terraform being my

GitHub Actions work really well for automating many tasks but if you use them heavily the costs can add up. If your bill has crept into the hundreds per month, this example could help.

https://lckhd.eu/I12bk4 AWS put out an open source benchmark called aws-bench that aims to measure how accurately and efficiently AI agents complete real-world AWS tasks. The test cases come from analysis of actual AWS usage rather than synthetic scenarios. Each case pairs a natural-language

https://lckhd.eu/Qly8kD Using Infrastructure as Code (IaC) to manage your resources is highly recommended and my favorite IaC tool is Terraform. Storing the state of your resources in a remote place is a good practice and ensuring multiple people don't change resources at the same time is also

https://lckhd.eu/z073BN Automating infrastructure testing is easy to talk about but harder to actually implement well. The article below walks through building a layered Terraform testing 🧵

https://lckhd.eu/5POhMi There are many ways to run containers on AWS but my default is using the Elastic Container Service (ECS). The setup and use of it can trip up a lot of people early on, mostly because Task Definitions, Tasks, and Services sound similar and what each is for is confusing. The

https://lckhd.eu/WccdZt Keeping an eye on costs and getting a breakdown of what was spent where is important. There is a lot of waste with Kubernetes clusters and a tool like Kubecost can help. 🧵

https://lckhd.eu/eltm03 AI tools have taken over the world in the last couple of years and they have varying levels of usefulness in my opinion. The AWS DevOps Agent is a really interesting one to me. In the example here it is used to debug GitHub Actions issues. This covers using the GitHub App

https://lckhd.eu/3fUzF9 Prometheus is a very useful tool. Many teams don't really use it to its full potential though. Typically it is installed and a few Grafana dashboards are imported and that's it. This gives a lot of value but in many cases the prebuilt dashboards won't have the data you

https://lckhd.eu/voxKFa In many cases, giving a team access to a private VPC could mean giving them .ovpn files. The example below uses a cleaner approach with an AWS Client VPN with SAML federation through Keycloak, so access follows corporate identity. The setup is done with Terraform including

https://lckhd.eu/YcNps2 Using Fargate for compute on AWS is a convenient choice for many cases although you pay a premium compared to EC2. Fargate cold starts are a real cost as well when your image is large. Every task pulls the whole thing before it runs, and most of that download is likely