标签：#AWS

As a software engineer starting with AWS, you might feel overwhelmed by all the services. Let me break down the key components with real-world examples to help you get started. 1. DNS & How AWS Route 53 Works Problem: Users can't remember IP addresses like 54.210.167.101 for your app. Solution: AWS Route 53 (DNS service) maps yourdomain.com to your servers. Real example: Your startup has servers in Ohio and Frankfurt. Route 53 automatically sends European users to Frankfurt and routes US traffic to Ohio — faster load times for everyone. 2. Networking: VPC & Subnets VPC: Your private cloud network (like an office building). Public subnet: For web servers (needs internet access). Private subnet: For databases (blocked from direct internet access). Internet Gateway: Connects public subnets to the internet. NAT Gateway: Lets private subnets reach the internet (one-way). Real example: In your e-commerce app, the web server runs in a public subnet while the database sits in a private subnet. 3. Storing & Delivering Static Files (S3 + CloudFront) Amazon S3: Stores images, videos, and logs. CloudFront (CDN): Caches content globally for faster loading. Real example: Your blog hosts images in S3; CloudFront caches them in 450+ locations, so a reader in Tokyo gets images from Japan instead of Virginia — cutting load time by ~50%. Pro tip: Enable S3 Versioning to recover accidentally deleted files. 4. Running Backend Services AWS Lambda (Serverless) — best for event-driven tasks. Example: a photo app resizes images automatically on upload. EC2 (Virtual Servers) — best for full control (custom OS, legacy apps). Example: hosting a Java monolith with specific dependencies. ECS/EKS (Containers) — best for microservices (Docker/Kubernetes). Example: a food-delivery app with separate services for orders, payments, and tracking. 5. Databases: Picking the Right One Amazon RDS (SQL): Structured data with relationships — e.g. user accounts + orders. DynamoDB (NoSQL): High-speed, scalable

Amazon Nova Pro matched a 4GB open-weight model running on a laptop on German PII redaction: 94% exact-value recall against 93%. Nova Micro, the cheapest model in the family, tied Amazon Comprehend on the same test at roughly a twentieth of the cost per document. And the model that lost hardest was the one fine-tuned for German. Here is what we measured across six approaches, two languages, and four orders of magnitude of cost. The blocker is not the model You have data. It contains names, email addresses, phone numbers, IBANs, dates of birth, health codes, account numbers. You want a language model to summarize it, classify it, extract from it, or index it for search. The model is capable. The data is ready. The personally identifiable information in it is what stops you. GDPR, HIPAA, and data processing agreements restrict where PII can transit, and approval for your cloud provider is not approval for every service inside it. Internal access controls make it worse rather than better: legal can see contract party details and finance cannot, but those boundaries live in your systems of record and dissolve the moment raw data enters a shared RAG index or a prompt template three teams call. An analyst asking for revenue from client X can get an answer derived from a contract they have no clearance to read. Then there is the leak nobody plans for. Production data reaches development accounts constantly, through payloads copied while debugging and dumps used to build test fixtures. And when the compliant workflow takes three days and the non-compliant one takes three minutes, people take the three minutes: a support engineer pastes a complaint into a consumer chatbot, a recruiter runs a CV batch through a free tool. This is not a security failure. It's a workflow design failure. A redaction layer separates the concerns. Process the data before it reaches any model, replace identities with typed placeholders, let the model work on structure and meaning. Which scale are y

AWS now allows vibe coding tool Superblocks to be embedded into the private clouds of AWS customers. It's another step towards decoupling apps from models.

More than a year ago, which is practically ancient history in the AI years, I wrote a blog about using AI to build new self-service capabilities. It felt like the future. We built a self-service action that could create new self-service actions, helping us move faster, reduce bottlenecks, and scale a small Platform Engineering team supporting hundreds of developers. One of the most interesting parts was using Amazon Bedrock to generate Terraform code dynamically at runtime, allowing the system to determine how a new cloud resource should be provisioned using our existing Terraform modules. It worked. It was impressive. And… we removed it. Looking back, abandoning that approach turned out to be one of the best engineering decisions we made. At the time, it felt like an isolated technical decision. It wasn’t. Recently, we faced a much smaller problem. We wanted to automate the creation of DNS records in Cloudflare through our self-service platform. The first proposal was exactly what you’d expect today: “Let’s build a Claude Skill.” Immediately, I had a strong sense of deja vu. But my hesitation wasn’t about whether AI could do it — it was about whether it should. We were simply asking the wrong question. The Industry Shift A lot of engineers today feel like everything they learned over the last decade suddenly became less relevant. We are DevOps engineers. We are Platform Engineers. We used to spend time designing systems, defining standards, reviewing architectures, and planning before writing a single line of code. Every automation started with the same question: “How should we automate this?” Today, that question has quietly changed. Now we ask: “How can AI do this?” At first glance, that sounds like progress. And sometimes it is. Large Language Models have fundamentally changed the way we build software. Tasks that used to take hours now take minutes, and entire prototypes appear from a single prompt. The temptation is obvious. If AI can do it… why not let AI do

Yesterday I announced I'm blogging daily on AWS & DevOps. Here's Day 1 — the fundamentals everything else builds on. ## What is Cloud Computing? Instead of setting up and maintaining infrastructure on-premises, you now access computing resources remotely over the internet — this is Cloud Computing. "Cloud" refers to a network that provides resources over the internet, accessible whenever needed. It evolved from grid computing, virtualization, and distributed computing. All you need to use it is a web browser. As per NIST , cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (networks, servers, storage, applications, services) that can be rapidly provisioned and released with minimal management effort. Key characteristics: uses virtualization, enables on-demand access, and offers "pay-as-you-use" pricing. Traditional companies had to spend heavily on infrastructure, hardware, and operations. With cloud computing, providers manage all of this — handling troubleshooting, recording activity, and sending analytics data to users. Service Models — IaaS, PaaS, SaaS IaaS : Providers offer databases, servers, storage, and networking as a service, and you pay per use. Examples: AWS, Azure, GCP. PaaS : Gives you an on-demand environment for developing, testing, and delivering apps, with ready dev tools already set up. Examples: Heroku, Google App Engine. SaaS : Delivers ready-to-use software over the internet, usually via subscription, with the provider managing everything underneath. - Examples: Gmail, Microsoft 365, Google Drive. The layered view: moving from On-Premise to IaaS to PaaS to SaaS, each model hands you a bigger pre-managed slice. On-premise means you manage everything yourself. IaaS shifts virtualization, servers, storage, and networking to the vendor. PaaS additionally hands over OS, middleware, and runtime. SaaS means the vendor manages everything — you just use the app. The biryani a

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . The build was done. Themis Lex worked on my machine, and not in the "works if you squint" way. A court clerk enters their role, describes their workflow, picks a data sensitivity level, and gets back a PDF with two sections: where AI can safely support the work, and where it must never touch it. Claude via Bedrock generates the assessment. Server-side PDF render. No accounts, no storage, session ends when the download does. Three weeks solo, for the Women in AI Accelerator Spring 2026 Build Challenge. Initial commit went in at 7:06pm on May 9. I pushed to AWS Amplify . Build went green. I opened the live site, filled out the form, hit submit. Nothing. Twenty eight seconds later, "Request timed out." I told myself the bug was not in my code. Everything ran locally. This had to be a platform problem. That belief carried me all night. It mostly held up. The exception was the first thing I should have checked. Here is the commit log, because it tells the story better than I can: 19:06 Initial commit: Themis Lex MVP 20:31 refactor: migrate Bedrock auth to IAM compute role 22:29 diag: log credential env vars at runtime (booleans only, remove after fix) 22:40 fix: forward BEDROCK_MODEL_ID to SSR runtime via next.config.js env 22:50 fix: switch to InvokeModelWithResponseStreamCommand to beat 28s Lambda timeout ... 06:28 fix: remove unused type export that broke isolatedModules build 06:37 fix: end-to-end response streaming to beat Amplify 28s gateway timeout 06:48 fix: reduce max_tokens to 3000 to fit Amplify 30s timeout 06:52 fix: reduce max_tokens to 2000, 3000 still exceeded 30s timeout 07:00 fix: switch to Claude Haiku 4.5 to fit Amplify 30s timeout Ten and a half hours from first deploy to the fix that shipped it. That gap between 22:50 and 06:28 is me sleeping on it, which turned out to be the second most productive thing I did. The error message was the absence of an error message My f

Three bugs we found and fixed in our own pipeline this week Journeymen grades developer work against GitHub's server-side history. That only means something if the grading pipeline itself is reliable — so here's the honest engineering update, not the highlight reel. 1. Silent progress loss on connect-repo analysis runs A connect-repo analysis run could sit in processing status with no visibility into what stage it was actually at, or whether it had stalled. From a dev's dashboard, a slow run and a stuck run looked identical. We added explicit progress-stage tracking so a stuck run is visibly stuck, not silently pending. 2. A background worker timing out without a clear signal The Lambda-based worker handling asynchronous analysis jobs was hitting its timeout under certain repo sizes, and the failure mode wasn't obvious from the outside — a run would just never complete. We root-caused the timeout and fixed the underlying slow path. 3. Dead-letter queue with no observability Jobs that failed enough times to land in the SQS dead-letter queue were, until this week, invisible — no alerting, no in-product surfacing. We wired up observability so a DLQ arrival is now a visible signal instead of a silent dead end. Why post about our own bugs The entire pitch of Journeymen is "don't trust the self-reported version, trust the verified one." That standard has to apply to us too. All three issues: found, fixed, and shipped this week. journeymen.in

We've all done it. You spin up an RDS instance to test something on a Friday afternoon. You attach an EBS volume to a t3.micro that you kill three days later — but the volume just... stays. You allocate a static IP for a load test, and the load test ends, but the IP doesn't know that. None of this shows up as an error. Nothing crashes. There's no red banner in the console screaming at you. It just quietly sits there, accruing charges, until you open your AWS bill a month later and go "wait, why are we paying for that ?" I call these zombie resources — infrastructure that's technically alive (and billing you) but functionally dead. It's happened to me enough times on side projects and client work that I've started designing a small tool to stop it: CloudZombie . Heads up: this is early. There's no working product yet — I'm validating the idea and building in the open, starting with a waitlist. If that's not your thing, no hard feelings, but if you've felt this exact pain before, I'd love your take. The problem, more specifically Cloud waste isn't usually one big dramatic mistake. It's death by a thousand cuts: Orphaned EBS volumes — you terminate an EC2 instance, but the attached volume doesn't get deleted with it, so it just sits in an "available" state forever. Idle databases — that staging or QA RDS instance nobody remembers spinning up, quietly running at under 1.5% CPU for weeks. Abandoned static IPs and load balancers — cloud providers actually charge more for an Elastic IP that isn't attached to anything, which feels like a small act of cruelty. Individually, each one is a few dollars a month. Collectively, across a handful of side projects or a growing team's sprawl of staging environments, it adds up to real money leaking out of your runway — with zero warning. What CloudZombie is meant to do The plan is for CloudZombie to connect (read-only) to your AWS account and scan specifically for these patterns: Unattached EBS volumes sitting idle Databases with sust

AWS Builder Center now offers free, time-limited sandbox environments for workshops, so developers no longer need to use their own AWS account and credit card or worry about unexpected charges. This has been a long-standing request from the community and removes one of the biggest friction points for practitioners learning new AWS technologies. By Renato Losio

I was on a call last month with a startup CTO who had just gotten their AWS bill. They had built a beautiful RAG application: semantic search, conversational AI, the works. Their vector index was humming along with about 50 million embeddings. Then they hit product-market fit. Within six weeks, they scaled to 500 million vectors. Their monthly infrastructure costs went from $2,000 to $20,000. The real kicker? When we looked at the access patterns, over 80% of those vectors were queried less than once a week. They were paying hot-storage prices for data that was, by any honest measure, cold. The standard advice here is "just use a cheaper vector database." The more interesting question is: why are you storing all your vectors at the same temperature in the first place? The Cost-Recall-Latency Triangle Vector search forces a three-way tradeoff. You can optimize for cost, recall, and latency, but you only get to pick two. Want high recall and low latency? That costs money (in-memory HNSW graphs with full-precision vectors eating RAM). Want high recall at low cost? Latency goes up. Want cheap and fast? Recall suffers. Most teams pick a single point on this triangle and apply it uniformly to every vector in their index. That decision made sense when vector databases offered a single storage tier. It makes the same amount of sense as storing your entire filesystem on NVMe SSDs because some files need fast access. The conventional wisdom says you pick your point on the triangle and live with it. But the conventional wisdom was written before vector storage got interesting. The better approach: tier your vectors the same way you already tier your storage. Different access patterns deserve different economics. The same embedding that costs $0.12/month in RAM might cost $0.004/month on disk and $0.0002/month in object storage. When you have 500 million of them, those decimals matter. The Hot Tier: In-Memory HNSW and Exact k-NN For vectors that get hit constantly (your user-fa

Usar IA no dia a dia não é nenhuma novidade, e praticamente TODO O MUNDO já sabe disso. E hoje temos diversos "sabores" de IA, inclusive para todos os gostos, e escolher um só é difícil, porque cada um tem seu molho especial em alguma tarefa específica. Eu, como não é novidade, acabei adotando como meu "favorito das últimas semanas" o Kiro...e confesso, muito no começo pelo ícone de fantasma que acho muito massa rss, mas conforme fui usando melhor, comecei a entender a sua estrutura, e principalmente o spec-driven, aí ele me conquistou de uma maneira meio que irreversível. E engraçado que hoje mais cedo quando estava dirigindo a caminho do supermercado, pensando nas minhas demandas e atividades, comecei já a estruturar meu "steering" mentalmente de uma nova task que precisaria fazer, e nisso me veio um pensamento...Caraca! Estou usando o Kiro para praticamente tudo! É isso que quero compartilhar com vocês hoje, um pouco de não só como estou usando, mas onde e para que! Trabalho nosso de todo dia Esse é meio que óbvio né? Seja um desenvolvedor, vibe-coder, arquiteto, engenheiro e tal, todo mundo está na onda de usar a IA para acelerar seu trabalho. Como comentei acima, o spec-driven do Kiro me conquistou porque eu não saio simplesmente "curando código gerado pela IA", eu realmente troco uma ideia com a IA e estruturo realmente a arquitetura daquilo que quero construir. A geração de código virou somente a consequência de toda essa sólida estrutura que conseguimos criar antes, e nesse ponto deixei de ser apenas um curador para assumir realmente a posição de arquiteto da feature que estou desenvolvendo. Conteúdo para comunidade Inclusive, esse artigo é fruto de um pouco disso! Não é sobre ser preguiçoso e deixar a IA gerar o conteúdo (o que eu acho errado também!), mas sim em "se transformar" em uma skill, onde você produz o conteúdo (VOCÊ criando o conteúdo!) e passa por essa skill para correção de gramática, compreensão, internacionalização e regionalização...uso muit

TL;DR I designed a proposed AWS Transform Custom community skill that prepares Glue 2.0, 3.0, and 4.0 repositories for Glue 5.0. It separates safe mechanical transformations from changes that require human evidence, generates a migration report, and preserves already-compatible files unchanged. Because I didn't have live atx access, the benchmarks in this post are explicitly labeled manually simulated, not agent-executed. The proposal is open as issue #75 — not yet merged, not yet a pull request. The missing data-engineering transformation AWS Transform Custom can apply agent-driven code transformations across a single repository — or thousands of them at once, via AWS Batch and Fargate. As of July 30, 2026, its public sample repository, aws-samples/aws-transform-custom-samples , contained three community-contributed transformations: an EKS version-upgrade-readiness skill, a JBoss-to-Spring-Boot migration, and a Kubernetes readiness migration. None of them touched data engineering. Given that most of my day-to-day work sits across AWS data engineering, Databricks, and Delta Lake, that gap was the obvious thing to fill. What an AWS Transform Custom "skill" looks like Before writing anything, I studied the deepest existing example, jboss-to-springboot , since the pattern it establishes is effectively an unwritten spec for the other two skills as well: README.md — the problem, what the skill does, and how to invoke it via the atx CLI. This is also where the repo draws a clear line: these are readiness transformations. They modify repository artifacts — code and infrastructure-as-code — but they don't deploy jobs, call AWS APIs to change running resources, or claim data-level equivalence. That distinction matters throughout everything below. SKILL.md — the agent-facing definition: YAML frontmatter with trigger keywords, an Objective, explicit Non-Goals , Constraints, worked before/after examples, a "signal in source code → reference file" routing table, and a numbered V

AWS Lambda can now reference deployment packages directly in customer-owned S3 buckets, removing the per-Region code storage quota and raising the managed default from 75 GB to 300 GB. Per-function package limits are unchanged, and UpdateFunctionCode is still required after replacing an object. Terraform provider support remains an open enhancement request. By Steef-Jan Wiggers

One day after a federal judge ordered an ICE detention center opened to state health inspectors, the agency posted new contract terms that would void state oversight at four facilities.

Runlayer is suing Rippling after Rippling evaluated the startup's MCP gateway product and then opted to build one itself.

This article provides a step-by-step guide to building and testing a cross-cloud currency agent. A coordinator built with Strands Agents and hosted on Amazon Bedrock AgentCore Runtime (in AWS us-east-1 ) discovers and delegates to a Google ADK agent (on GCP Cloud Run in us-central1 ) over A2A v1.0 , cross-checks results against an MCP exchange-rate tool , and measures what independent cross-cloud verification costs in latency, reliability, and overhead. What is This Project Trying to Do? Most Agent-to-Agent (A2A) protocol demos stop at "look, the HTTP 200 OK request succeeded." That is a smoke test, not an interoperability benchmark. This project goes further: an Amazon Bedrock AgentCore-hosted Strands Agents coordinator discovers and delegates to a Google ADK agent running on GCP Cloud Run, comparing the results against a local MCP stdio exchange-rate tool backed by live Frankfurter daily reference rates. We also compare the performance, developer experience, and wire compatibility directly against our previous benchmark run hosted on Microsoft Foundry in Azure ( gpt-5-mini ), giving us a true cross-cloud benchmark across AWS, Azure, and GCP. The questions we answer with hard empirical data rather than vibes: Can an AgentCore-hosted Strands agent discover and invoke a Google ADK agent through an A2A agent card with no framework-specific glue? What latency and token overhead does remote-agent verification add? Does independently verifying an MCP tool result over A2A improve correctness or failure recovery enough to justify that overhead? How does AWS Bedrock AgentCore Runtime compare like-for-like with Microsoft Foundry on Azure? Reduce, Re-Use, Re-Cycle! This builds directly on the currency agent from the previous articles in this series: Getting Started with MCP, ADK and A2A | Google Codelabs GitHub - jackwotherspoon/currency-agent That agent — built with Google ADK, Gemini 2.5 Flash, and a FastMCP exchange-rate server backed by the free Frankfurter API — serves a

This is a cross-post from The Agentic Engineer newsletter — Issue #23. The Big One: Claude Opus 5 Lands on Amazon Bedrock The first 5th-generation Opus is here. Claude Opus 5 landed on Amazon Bedrock on July 24. Anthropic's claim: it matches Fable 5 intelligence across agentic coding, knowledge work, visual understanding, and long-horizon tasks. At Opus pricing. That last part matters. Fable 5 was positioned as enterprise-tier compute. Most teams weren't running it at scale because the economics didn't work. Opus 5 changes that math. Same capability class, Opus price point. If the benchmark holds in production, this is the model shift that makes frontier-quality agentic pipelines practical outside big-company infra budgets. Two deployment details worth calling out. Zero Data Retention is on by default. It also runs on Bedrock's next-generation inference engine — lower latency than comparable Anthropic-hosted deployments. Quick Hits This Week Kimi K3 Open Weights : Moonshot AI dropped 2.8T MoE, 1M context, native tool calling. First frontier model built agent-native from the ground up. OpenAI Presence : Full-stack enterprise agent platform with job-scoped access, policy layers, and a Codex-powered improvement loop. Runs OpenAI's own phone support at 75% resolution. OmniRoute : 31,542 stars (+10,912 this week). 290+ providers, quota-aware fallback, MCP/A2A support. One endpoint for all your coding agents. Claude Code 2.1.218 : /code-review and /deep-research now run as background subagents. Main conversation stays clean. AWS Security Hub MCP Server : Exposure findings, attack paths, and remediation recommendations directly in Claude Desktop. Tool of the Week: Amazon GuardDuty Investigation Agent Free during preview. Auto-correlates findings across CloudTrail, VPC Flow Logs, DNS logs. Returns risk level, MITRE ATT&CK mappings, and remediation recommendations in minutes. Available via MCP through the AWS Agent Toolkit. Available in 10 commercial AWS regions. Up to 10 in

Recursive’s $400 million outlay represents the bulk of the company’s fundraising to date.

AWS released a public preview of the GuardDuty investigation agent, which correlates findings, 90-day activity logs, and resource topologies into structured reports with risk ratings, confidence scores, and MITRE ATT&CK classification. It is reachable through the AWS MCP Server, so investigations can run from agentic tooling. Preview quotas cap usage at 10 investigations per account per day. By Steef-Jan Wiggers

As part of the Förderverein AWS Community DACH e.V. I joined the selection committee for talks again this year. Third year in a row (I wrote about the previous editions and my broader community journey in my 2025 year in review ). The process is always inspiring, fair, and full of incredibly well-crafted abstracts. How the evaluation works Sessionize uses a Comparison Evaluation Mode based on the Elo rating system (from chess). Three sessions are shown at the same time and you rank them relative to each other. You don't assign absolute scores; you just decide "this one is better than that one." Each comparison produces three "games" (A vs B, B vs C, C vs A) and the algorithm adjusts ratings accordingly. After a first pass through all sessions, the system gets smarter about which triplets to show next, targeting sessions with similar ratings for more precise differentiation. It's fast, focused and surprisingly fair, because you only ever think about the three in front of you, not all others. You can also use "Strong opinion" options: Top (this is excellent), Doesn't fit (wrong conference), or Ignore (conflict of interest, can't judge). These signal the algorithm without distorting the ranking. In my case: I marked 2 as "Doesn't fit" (not because they lacked quality; they were actually interesting but too inspirational for a technical community day, better suited for a different audience). The other 2 ignored were my own submissions : Vibecoding in Between Meetings and Serverless vs Kubernetes - The Final Showdown . The full process The behind-the-scenes post by Philipp Garbe explains the whole pipeline in detail. In short: Round 1 (Screening): Board members filter out spam, incomplete proposals, marketing pitches, non-AWS topics, and speakers outside EMEA. Round 2 (Content Evaluation): Every association member can participate. This is the Elo-based comparison round. Members must disclose personal connections and skip sessions they can't rate objectively. Round 3 (Fin