About builders, building stuff, getting things done and lessons learned on public cloud.
You're a SaaS vendor closing a deal with a major customer — but with one condition. Your product must run inside their AWS account. You want the deal. But that means your competitive advantage, the secret sauce that makes your product unique, is now deployed into an account you don't control. IAM policies won't save you. Encryption at rest won't either — not when the account administrator has…
This post demystifies the process of setting up S3 Vector as Bedrock Knowledge Base by walking through complete implementation in CloudFormation. Examining the infrastructure as code will reveal components, dependencies, and permissions required—bringing full transparency to the "magic" that happens when the same is build from AWS console.
Shortly after I published my post about how "You don’t need NAT gateway to deploy Lambda into VPC", AWS announced Regional NAT Gateway. Whilst IPv6 eliminates the need for NAT entirely, Regional NAT Gateway represents a major update to best practices for IPv4 VPC networking.
In this episode of VPC Dealers we're taking on a Lambda function that's been running in a VPC with NAT gateway for years. It works fine but those hourly charges keep adding up. Time to do what Ant did with that Maserati Biturbo - rip out the old combustion engine and drop in something electric. We're converting from NAT gateway to Egress-only gateway with IPv6, cutting the running costs while…
AWS Lambda remote debugging allows debugging Lambda functions running in the cloud directly from local IDE. With this new capability, it is possible use familiar debugging tools like breakpoints, variable inspection, and step-through debugging with functions deployed in the cloud.
Those of you who have been working as network admin or someone who's work depends on network, you know when things stop working, network is always first to blame until proven innocent. To get to correct root cause it is important to quickly rule out, or find evidence of, network problems. This is where AWS Reachability Analyzer can help network admins but also let anyone to verify basic…
In this episode I've inherited an old web service build on common VPC design for its time. Architecture is basicly ok and fit for the purpose. Public and private resources are in their separate subnets. Only the application load balancer (ALB) is exposed to internet and EC2 instances in private subnets are protected from direct internet access. But today we can do better and with little effort,…
At the age of genAI it is valuable to have access to expert generated content and not just trying out random advices found from internet forums full of chatbots. If you are working as linux admin, and especially when using RHEL or one of it's derivative distributions Red Hat Knowledge Base can become very helpful resource. But some of the content requires a subscription ...
First +10 years of AWS service lifecycle management was just continous stream of announcements about new services and features. And many (most?) of the services that got out to public are still there with backwards compatibility all the way to the beginnings. But it isn't realistic to think one could just continue building new stuff year after year. At some point you must start end-of-life process…
I've been hanging around at repost.aws for a while because the best way to keep your skills fresh is to see what challenges other people have in real life and check if can solve those. And maybe learn something new during the process. That is also how this post got started ...