Cloud & AWS
VPC, EC2, S3, RDS, ECS, Route 53, cost, architecture and disaster recovery.
Cloud & AWS articles
GuardDuty and Security Hub, Explained
GuardDuty is threat detection from your AWS telemetry; Security Hub aggregates findings and runs compliance checks. Here's what each does and how to wire them to a response.
October 24, 2026CloudFront Cache Behaviors, Explained
A CloudFront distribution routes paths to origins via ordered cache behaviors. Here's the cache key model, cache vs origin-request policies, and TTL precedence.
October 24, 2026ALB vs NLB (and When to Use Each)
ALB is an L7 HTTP router with rich features; NLB is an L4 pass-through with static IPs and raw throughput. Here's the decision, feature by feature.
October 24, 2026AWS WAF: The Rules That Matter
AWS WAF filters HTTP requests at the ALB/CloudFront/API Gateway edge. Here's a sensible baseline Web ACL, how to tune with count mode, and the false-positive traps.
October 24, 2026VPC Endpoints and PrivateLink
VPC endpoints let instances reach AWS APIs (and your own services) without a NAT Gateway or internet route. Here's gateway vs interface endpoints and the DNS gotcha.
October 24, 2026Lambda Cold Starts and How to Cut Them
A cold start is the init cost of a fresh execution environment. Here's what drives it — runtime, package size, VPC, your init code — and the levers that actually help.
October 24, 2026SQS vs SNS vs EventBridge
SQS is a queue (one consumer group), SNS is pub/sub (fan-out to many), EventBridge is a routing bus with filtering and schemas. Here's how to choose.
October 24, 2026AWS Secrets Manager Rotation
Automatic secret rotation swaps credentials on a schedule with zero downtime — if the Lambda's four steps and staging labels are right. Here's the model and the failure modes.
October 24, 2026DynamoDB Single-Table Design Basics
DynamoDB rewards designing the table around your queries, not your entities. Here's the key model, single-table design, GSI overloading, and the hot-partition trap.
October 24, 2026AWS IAM Policy Evaluation Logic
Every AWS request runs through the same decision tree. Learn the order — explicit deny, SCP, boundary, then allow — and 'why is this denied' stops being a mystery.
October 24, 2026RDS vs Aurora, and How Failover Works
RDS Multi-AZ replicates a whole instance; Aurora separates compute from a distributed storage layer. That changes failover time, read scaling, and cost.
October 24, 2026Route 53 Routing Policies, Explained
Route 53 can do a lot more than map a name to an IP. Weighted for canary, failover for DR, latency for global apps — here's each policy and when to use it.
October 24, 2026