197 articles
Knowledge Base
AWS
197 articles in the AWS category · page 7 of 9.
- Control Tower Account Factory — the new-account checklist that actually closes A repeatable new-AWS-account procedure using Control Tower Account Factory plus Customizations for Control Tower (CfCT), with the post-vending checklist that catches the items the factory does not cover.
- NLB static-IP pattern — partner allow-lists that survive load balancer replacement Elastic IPs on an NLB never rotate. The partner allow-list survives target replacements, AZ failures, and most operational changes — except an NLB swap. Here is the pattern and the migration playbook for when you have to swap it.
- AWS WAF on ALB — managed rules, rate-based blocks, and the COUNT-then-BLOCK promotion pattern WAF in front of ALB stops the credential-stuffing campaign that gets through the rate limit at the application. Managed rule groups, rate-based rules, and the discipline of running every new rule in COUNT mode for a week before promoting to BLOCK.
- Organizations SCP baseline — guardrails that survive an account-factory rollout A pragmatic Service Control Policy baseline for AWS Organizations — deny regions, deny root, block IMDSv1, protect CloudTrail, with the test loop that proves you did not lock yourself out.
- Compute Optimizer right-sizing — where it sees clearly, where it is blind, and the gating rules Compute Optimizer reads 14 days of CloudWatch and recommends right-sizes across EC2, ASG, Lambda, and EBS. The engine is genuinely good but it is blind to spiky workloads and burstable credit. Here is how to accept the recommendations safely.
- RDS / Aurora encryption with customer-managed KMS keys — the gotcha you cannot reverse Encryption at rest is set at create time and cannot be changed. Customer-managed KMS keys give you the audit trail and the ability to revoke. Key rotation is automatic but does not re-encrypt data. Cross-account snapshot sharing requires a precise key policy. The actual setup and the trust block that has to align.
- Target tracking vs step scaling — picking the right ASG policy for the workload Target tracking is the default for a reason — but it flaps on bursty workloads. Step scaling is more code, more right for cron-driven batch. Here is how to decide and how to spot a target-tracking policy that is fighting itself.
- RIs, Savings Plans, Spot, and on-demand — the decision matrix per workload shape Reserved Instances vs Savings Plans (Compute vs EC2 Instance) vs Spot vs on-demand. The choice is not about discount — it is about the workload shape and the lock-in you can absorb. Here is the decision matrix and the break-even reasoning.
- AWS Backup with cross-region and cross-account copy — the restore-test that proves it actually works AWS Backup centralizes backup across EBS, RDS, EFS, DynamoDB, S3. Backup plans, vaults with cross-region and cross-account copy, KMS, and the restore-test loop that turns a green backup into proven recoverable data.
- CodePipeline vs GitHub Actions: when CodePipeline earns its keep CodePipeline wins on IAM-native cross-account deploys, residency, CodeDeploy blue/green. GH Actions wins on iteration speed and ecosystem. The honest middle ground: GH Actions for CI, CodePipeline for deploy.
- VPC peering vs PrivateLink — full reachability or service-only, and which one your partner actually wants Peering connects two VPCs at the network layer. PrivateLink exposes one service across that line. The choice changes who has to handle CIDR overlap, DNS, and least privilege.
- The CloudWatch alarm baseline every production SaaS needs — copy-pasteable CloudFormation The eleven CloudWatch alarms that catch the failure modes a production SaaS actually experiences. ALB 5xx rate, target health, RDS connections and replica lag, ASG capacity, NAT GW bandwidth, certificate expiry. Here is the set.
- VPC Flow Logs analysis — the Athena queries you run when a leaked IP comes up Flow Logs to CloudWatch is convenient and expensive. Flow Logs to S3 is cheap and queryable. The cost gotcha is enabling them VPC-wide on a high-traffic environment without filtering.
- Mixed instances policy — running on-demand base plus spot surge without blowing up Spot is half the cost or better. Using it under an ASG with a sensible on-demand base, diversified across instance families and AZs, takes a half hour of policy work. Here is the configuration that survives an interruption storm.
- Multi-AZ subnet design for a real 3-tier VPC — the CIDR plan that survives year three Three AZs, three tiers, /20 per AZ, and a deliberate plan for the next environment. The mistake is treating subnets as a one-time task. Here is the layout that does not run out of IPs.
- ElastiCache snapshots — daily, on-demand, and the case for restoring empty Daily automatic snapshots cover the routine. Manual snapshots cover the risky change. Restore-to-new-cluster is the safe recovery path. Sometimes the right move after a corruption is to start with an empty cache instead.
- ALB pre-application auth — Cognito and OIDC at the load balancer ALB can authenticate the request before it ever reaches your target. Cognito user pools, Okta or Auth0 OIDC, JWT forwarded to the app. The pattern saves you from rolling your own auth gateway for internal tools and admin consoles.
- CodeCommit PR approval rule templates — N reviewers, CI gate, repo-scoped by tag CodeCommit approval rule templates enforce required reviewers and CI status on PRs. Here is the exact create-approval-rule-template invocation and the scoping by repo tag.
- ElastiCache cost levers — node type, reservations, and the oversized-Redis pattern The second-most-expensive line on a SaaS AWS bill is often an oversized Redis. Pick the right node family for the workload, apply reserved instances on the steady-state, and right-size the working set — three levers that compound.
- End-to-end CodePipeline for a SaaS — the template that actually ships to prod A full SaaS pipeline reference: Source, Build, parallel tests, staging deploy, manual approval, prod blue/green, post-deploy validation. The CloudFormation stanza for each stage, not the marketing diagram.
- Transit Gateway hub-and-spoke — when peering stops paying and TGW earns its keep VPC peering is fine for two VPCs and tolerable for four. Past five, the full-mesh peering count makes TGW the right move. Here is the working setup, RAM sharing, and the on-prem attach.
- EC2 vs ELB health checks — why InService instances still serve 500s The ASG says every instance is InService. The ALB target group says half are Unhealthy. Both are right, and the gap is one configuration flag away. Here is how the two health-check models interact and the grace-period gotcha that breaks deploys.
- ALB listener rules — host and path routing at scale Host-based for multi-tenant subdomains, path-based for SPA + API, weighted target groups for canary, fixed-response 503 for maintenance. And the 100-rule cap that blocks you at customer 90.
- Warm pools — cutting scale-out from minutes to seconds when bootstrap is slow Bake the AMI smaller and you still wait a minute. Some workloads need the box ready in twenty seconds. Warm pools hold pre-bootstrapped instances in a stopped state and bring them to InService in the time the LB takes to check them.