Author
Independent AWS architect. 9+ years production cloud. 6x AWS certified, including Solutions Architect Professional and GenAI Developer Professional. 4x AWS Community Builder.
Recent work
Most S3-to-Lambda setups skip CloudTrail data events entirely and pay for it later with brittle fan-out and zero audit trail. This post walks through a CDK TypeScript stack that routes S3 events through EventBridge properly — VPC placement, KMS encryption, Secrets Manager, cost model, and the failur
Wiring CodePipeline, CodeDeploy, and Auto Scaling in CDK sounds straightforward until your first real scale event cracks the deployment. This post walks the full architecture - VPC, ALB, ASG, SSM config, and the lifecycle hook settings that keep deploys clean under load.
Most CDK tutorials stop at 'it deployed.' This one covers the full aws cdk web application deployment stack - VPC isolation, Fargate on private subnets, Aurora with KMS, CloudFront, Secrets Manager rotation - and the six operational gaps that will wake you up at 2am if you skip them.
Coordinating DataSync, DMS, Glue, and OpenSearch under a single Step Functions control plane sounds clean until one service is not ready and the whole pipeline silently produces incomplete data. This post dissects a CDK TypeScript stack that wires all four services together and shows exactly where i
Security drift starts the moment someone opens the AWS console. This post walks through a production CDK TypeScript stack that enforces KMS encryption, least-privilege IAM, VPC Endpoint routing for secrets, WAFv2 on CloudFront and API Gateway, and Security Hub — all as versioned, testable code.