Author
Production-first notes on AWS, platform engineering, reliability, observability, AI infrastructure, and the trade-offs most demo articles skip.
Recent work
Running dev, staging, and prod on separate VPCs sounds clean until you need them to talk — and your Aurora failover has never actually been tested. This post walks through a real CDK TypeScript stack wiring Transit Gateway, Aurora Global Database, ECS Fargate, and Global Accelerator across three env
Most AWS accounts get hardened once by someone who no longer works there. This post walks through a CDK TypeScript stack that encodes VPC isolation, KMS key policies, IAM least-privilege, AWS Config rules, WAF, and CloudTrail into version-controlled, PR-reviewable infrastructure — so your security p
Most S3-to-Lambda setups skip CloudTrail data events entirely and pay for it later with brittle fan-out and zero audit trail. This post walks through a CDK TypeScript stack that routes S3 events through EventBridge properly — VPC placement, KMS encryption, Secrets Manager, cost model, and the failur
Wiring CodePipeline, CodeDeploy, and Auto Scaling in CDK sounds straightforward until your first real scale event cracks the deployment. This post walks the full architecture - VPC, ALB, ASG, SSM config, and the lifecycle hook settings that keep deploys clean under load.
Most CDK tutorials stop at 'it deployed.' This one covers the full aws cdk web application deployment stack - VPC isolation, Fargate on private subnets, Aurora with KMS, CloudFront, Secrets Manager rotation - and the six operational gaps that will wake you up at 2am if you skip them.
Your IAM permissions are a wiki page nobody trusts. This post walks through a CDK TypeScript stack that encodes KMS encryption, IAM roles, and RDS storage security as versioned, reviewable code - and covers the operational traps most tutorials skip entirely.
Coordinating DataSync, DMS, Glue, and OpenSearch under a single Step Functions control plane sounds clean until one service is not ready and the whole pipeline silently produces incomplete data. This post dissects a CDK TypeScript stack that wires all four services together and shows exactly where i
Security drift starts the moment someone opens the AWS console. This post walks through a production CDK TypeScript stack that enforces KMS encryption, least-privilege IAM, VPC Endpoint routing for secrets, WAFv2 on CloudFront and API Gateway, and Security Hub — all as versioned, testable code.