AWS Service Guides
One service at a time, from someone who runs them.
Working guides to individual AWS services — what each one is genuinely good at, the limits you'll hit, and the cost characteristics that only show up once you're in production.
21 articles in this series
- 0123 min
AWS Account Factory for Terraform (AFT): What It Is, How It Works, and When It's Overkill
AFT turns AWS account creation into a pull request. It is also a dedicated account, four git repositories, a Step Functions pipeline, and a standing NAT gateway bill before you vend anything. Here's how it actually works, how it compares to stock Control Tower and Landing Zone Accelerator, and the account count below which it is the wrong tool.
Read - 0210 min
AWS Security Groups vs NACLs: Stateful vs Stateless, and When Each One Matters
Security Groups and Network ACLs both filter traffic in a VPC, but they operate at different layers, evaluate rules differently, and fail in different ways. Here's how I decide which one to reach for — and the ephemeral port mistake that breaks NACLs for almost everyone.
Read - 0312 min
AWS Lambda Managed Instances: What Actually Changed and When to Use It
Lambda Managed Instances runs your functions on dedicated EC2 in your account — no cold starts, 32 GB memory, multi-concurrent invocations, and EC2 Savings Plans pricing. It's a fundamentally different execution model. Here's what changed, when it's cheaper than standard Lambda, and what it means for AI inference workloads.
Read - 0413 min
AWS Route 53: DNS, Routing Policies, and Health Checks
Route 53 is AWS's DNS service — authoritative DNS for your domains, health checking, and traffic routing logic. Beyond simple A records, Route 53 provides routing policies that enable failover, latency-based routing, weighted traffic splits, and geolocation routing. This covers Route 53 hosted zones, record types, routing policies (simple, failover, latency, weighted, geolocation, geoproximity, multivalue), health checks, private hosted zones for VPC-internal DNS, resolver rules for hybrid environments, and the operational patterns for zero-downtime DNS changes.
Read - 0514 min
AWS Step Functions: Orchestrating Distributed Workflows
Step Functions lets you coordinate Lambda functions, ECS tasks, DynamoDB operations, and external services into durable state machines — with built-in error handling, retries, parallel execution, and audit history. This covers state machine types (Standard vs Express), state types (Task, Choice, Parallel, Map, Wait), error handling patterns, the integration catalog, and operational considerations for production workflows.
Read - 0615 min
AWS IAM: Roles, Policies, Permission Boundaries, and IRSA for EKS
IAM is the authorization layer for everything in AWS. Getting it wrong means either over-privileged workloads that expand your blast radius, or under-privileged ones that fail at runtime. This covers IAM identity types, policy evaluation logic, permission boundaries, IRSA for EKS pod-level AWS access, cross-account role assumption, IAM Access Analyzer, and the patterns that work at scale across multiple AWS accounts.
Read - 0716 min
AWS VPC Design for EKS: Subnets, NAT Gateways, and Security Groups
Every EKS cluster lives inside a VPC. How that VPC is designed — CIDR ranges, subnet layout, NAT configuration, VPC endpoints, and security group rules — determines the cluster's networking performance, security posture, and operational overhead. This covers production-grade VPC design for EKS: subnet sizing for large pod counts, private vs public node placement, NAT Gateway vs NAT instance trade-offs, VPC endpoints to keep traffic off the internet, security groups for nodes and pods, and VPC peering vs Transit Gateway for multi-VPC connectivity.
Read - 0815 min
AWS RDS and Aurora: Managed Database Patterns on AWS
RDS removes the operational burden of database installation, patching, backups, and replication — but choosing between RDS and Aurora, sizing the instance, configuring parameter groups, and setting up read replicas correctly still requires understanding the trade-offs. This covers RDS PostgreSQL vs Aurora PostgreSQL, Multi-AZ and read replica architecture, RDS Proxy for connection pooling, backup and snapshot strategy, Performance Insights for query-level visibility, and when to choose Aurora Serverless v2 over provisioned.
Read - 0913 min
AWS Secrets Manager and Parameter Store: Secrets Management on AWS
Managing secrets on AWS means choosing between Secrets Manager and Parameter Store, understanding automatic rotation, and integrating secrets into EKS workloads without long-lived credentials in environment variables. This covers the Secrets Manager vs Parameter Store trade-offs, automatic rotation with Lambda, cross-account secret sharing, External Secrets Operator and CSI driver integration for Kubernetes, secret versioning and rollback, and audit logging via CloudTrail.
Read - 1014 min
AWS ECS vs EKS: Choosing the Right Container Orchestrator on AWS
ECS and EKS are both AWS container orchestrators, but they reflect fundamentally different design philosophies. ECS is a tightly AWS-integrated managed service with a simpler operational model. EKS runs Kubernetes — more powerful, more complex, more portable. The choice isn't always obvious. This covers ECS architecture (tasks, services, clusters), ECS on Fargate vs EC2, how ECS compares to EKS on networking, IAM, scaling, and operational burden, and the workload patterns where each makes sense.
Read - 1115 min
AWS Cost Optimization: EC2 Pricing Models, Spot, Savings Plans, and EKS Cost Control
AWS bills go wrong in predictable ways: on-demand instances running 24/7 that could be Reserved or Spot, EBS volumes attached to stopped instances, NAT Gateway data transfer charges that VPC endpoints would eliminate, and CloudWatch metrics that nobody reads. This covers EC2 pricing models (On-Demand, Reserved, Savings Plans, Spot), right-sizing strategies, EKS-specific cost controls (Karpenter consolidation, Spot node groups, namespace cost allocation), data transfer cost reduction, and the tooling to find what's actually costing you money.
Read - 1214 min
AWS CDK: Infrastructure as Code in TypeScript and Python
The AWS CDK lets you define cloud infrastructure using real programming languages — TypeScript, Python, Java, Go, and others — instead of YAML or JSON templates. This covers CDK concepts (Constructs, Stacks, Apps), the L1/L2/L3 construct hierarchy, CDK Pipelines for CI/CD, testing CDK stacks with CDK Assertions, common patterns for EKS and RDS provisioning, environment-specific configuration, and CDK vs Terraform trade-offs.
Read - 1315 min
AWS Lambda: Functions, Event Sources, Layers, and Serverless Patterns
Lambda runs code in response to events — HTTP requests, S3 uploads, SQS messages, DynamoDB streams, EventBridge rules — without servers to provision or manage. This covers Lambda execution model (cold starts, concurrency, memory-to-CPU ratio), event source mappings for SQS and DynamoDB Streams, Lambda Layers for shared dependencies, environment configuration with Secrets Manager, container image functions, Lambda@Edge and CloudFront, power tuning, and the architectural patterns where Lambda excels vs where it doesn't.
Read - 1414 min
AWS Messaging: SQS, SNS, and EventBridge
SQS, SNS, and EventBridge are the three primary messaging services on AWS — each with different delivery semantics, ordering guarantees, and integration patterns. SQS provides durable queues with at-least-once delivery. SNS fans out messages to multiple subscribers simultaneously. EventBridge routes events from AWS services and your applications to multiple targets based on pattern matching. This covers SQS (standard vs FIFO, DLQs, visibility timeout, long polling), SNS (topic fan-out, message filtering, cross-account delivery), EventBridge (custom buses, event patterns, Scheduler), and how these services compose into reliable event-driven architectures.
Read - 1515 min
AWS DynamoDB: Data Modeling, Capacity, Indexes, and Streams
DynamoDB is a fully managed key-value and document database that scales to any throughput with single-digit millisecond latency. The design trade-offs — single-table design, access patterns dictate schema, no ad-hoc queries — require deliberate data modeling upfront. This covers DynamoDB data model (partition keys, sort keys, composite keys), capacity modes (on-demand vs provisioned, auto-scaling), Global Secondary Indexes and Local Secondary Indexes, transactions, DynamoDB Streams for CDC, TTL, and the access pattern-first design methodology that makes DynamoDB work at scale.
Read - 1613 min
AWS ElastiCache: Redis, Valkey, and Caching Patterns for Production
ElastiCache provides managed Redis and Valkey (the open-source Redis fork) on AWS. Caching reduces database load, cuts latency, and absorbs traffic spikes — but only when the cache is correctly populated, invalidated, and sized. This covers ElastiCache architecture (cluster mode, replication groups, Multi-AZ failover), the major caching patterns (cache-aside, write-through, read-through), session storage, distributed locking, and the operational considerations that distinguish a well-tuned cache from a liability.
Read - 1713 min
EKS Cluster Upgrades: Zero-Downtime Strategy for Production
Upgrading an EKS cluster in production without downtime requires a specific order of operations: control plane first, then addons, then nodes — with validation at each step. Skipping versions, upgrading nodes before addons, or draining too aggressively during business hours are the most common causes of upgrade incidents. This is the process that avoids them.
Read - 1814 min
AWS CloudWatch: Logs, Metrics, Alarms, and Container Insights for EKS
CloudWatch is AWS's native observability service — logs, metrics, alarms, dashboards, and distributed tracing via X-Ray. For EKS, Container Insights adds Kubernetes-aware metrics and log aggregation. This covers CloudWatch Logs with log groups and retention, Metrics and metric math, Alarms with composite alarms, CloudWatch Agent for custom metrics, Container Insights setup on EKS, EMF (Embedded Metric Format) for high-cardinality metrics, and X-Ray distributed tracing for service-to-service visibility.
Read - 1914 min
AWS Load Balancer Controller: ALB and NLB for EKS
The AWS Load Balancer Controller provisions and manages ALBs and NLBs from Kubernetes Ingress and Service resources. It replaces the in-tree Kubernetes cloud provider integration for load balancers on EKS and gives you full control over ALB configuration — listener rules, target groups, WAF, OIDC authentication, and IngressGroups that share a single ALB across multiple services.
Read - 2012 min
AWS Graviton ARM64 Migration Guide: Real Cost Savings and What Actually Breaks
Graviton3 instances cost up to 20% less than equivalent x86 instances, with additional performance gains on memory-bound workloads — but migrating isn't just flipping a flag. Here's what breaks on ARM64 and the exact strategy to migrate without downtime.
Read - 215 min
The Silent Cost: How Docker Pulls Through NAT Gateway Can Bankrupt You
We found a quiet AWS environment racking up huge bills. The culprit? Repeated Docker image pulls through a NAT Gateway. Here is the case study and how we fixed it.
Read
Other series
Troubleshooting Guides
Paste the error, get the fix.
Tool Comparisons
X vs Y, decided on what matters in production.
What Is… Explainers
Plain definitions of terms that get used loosely.
AI & LLM Infrastructure
Running models yourself, and knowing when not to.
CI/CD Pipelines
Building, testing and shipping, without the pipeline owning you.
Kubernetes
The cluster, end to end.