197 articles
Knowledge Base
AWS
197 articles in the AWS category · page 8 of 9.
- Automatic rollback on CloudWatch alarm — wiring it once and stopping the nightly rollback loop Wiring CodeDeploy automaticRollbackConfiguration to CloudWatch alarms is mechanical. Keeping the alarms tight enough to catch regressions but loose enough not to rollback every Tuesday at 03:00 — that is where teams go wrong.
- ALB vs NLB vs GWLB — pick the right load balancer the first time ALB is L7 and HTTP-aware. NLB is L4 with static IPs. GWLB inserts third-party appliances. Most teams reach for ALB by default and live with the wrong choice for two years.
- AWS CodeCommit vs GitHub: when CodeCommit is still the right call (and when it isn't) AWS stopped onboarding new CodeCommit customers in 2024. For existing users the question is now binary — keep it for the residency and IAM wins, or migrate before deprecation forces a rushed cutover.
- CodeBuild VPC mode — when to use it and what it costs you CodeBuild in a VPC for private RDS, internal APIs, and integration tests against private endpoints. NAT cost, IP exhaustion, ENI cold-start trade-offs explained.
- ECS rolling vs blue/green via CodeDeploy — when each pattern earns its keep ECS native rolling deploys update task definitions in place. CodeDeploy blue/green provisions a second task set and swaps the listener. Each pattern fits a specific failure model — here is when each one is the right call.
- IAM roles on EC2 — instance profiles, IMDSv2, and the access-key anti-pattern that still surfaces in 2026 An EC2 instance with AWS credentials hard-coded into /etc/aws/credentials is a 2014 problem that still shows up in audits in 2026. Instance profiles fix it. Here is the least-privilege setup, the IMDSv2 enforcement, and the unused-permission cleanup loop.
- ElastiCache cluster mode vs replication group — which Redis topology fits a SaaS workload Cluster mode shards data across primaries to scale beyond one node's memory; replication groups give you read replicas and a single keyspace. The choice changes your client library, your key design, and your failure mode.
- CodeBuild cost control — taming build-minute spend on a fast team Compute sizing, build parallelism, batch builds, path filters, ephemeral integration envs. Real CloudWatch and Cost Explorer queries to find runaway build jobs.
- NAT Gateway vs NAT instance — the egress-cost cliff and when VPC endpoints flip the question NAT Gateway is managed and multi-Gbps. NAT instance is cheaper at low scale. Neither is the answer if endpoints can take the traffic. Here is the decision frame and the numbers.
- CodePipeline artifact store encryption — the KMS trust block that breaks without kms:ViaService Customer-managed KMS keys for the artifact bucket, cross-account key sharing for shared pipelines, bucket policies that block unencrypted uploads, key rotation. The kms:ViaService condition you cannot skip.
- Read replicas in a multi-tenant SaaS — per-tenant reads, lag traps, and when to promote Routing tenant reads to a replica scales the writer, until a dashboard reload shows a stale value and the customer opens a ticket. Here is the lag-visibility checklist, the read-your-own-writes pattern, and the threshold where promoting a replica to a dedicated tenant DB makes sense.
- appspec.yml anatomy for EC2 — every hook, every order, every runas that bites The full appspec.yml reference for EC2 deploys — hook ordering, runas users, the hooks people skip and regret, and the file_exists_behavior that overwrites a config you needed.
- Security groups vs NACLs — stateful at the ENI, stateless at the subnet, and why most VPCs ignore NACLs Security groups are stateful and allow-only. NACLs are stateless and have deny rules. The ephemeral-port gotcha bites every team that tries to lock down with NACLs once.
- Secrets Manager vs SSM Parameter Store — when each one is the right call Secrets Manager rotates and costs per secret. Parameter Store is free, hierarchical, and never rotates. The decision is not about cost — it is about which failure mode you can absorb. Here is the matrix and the IAM policy split.
- RDS / Aurora PITR + snapshot strategy — the runbook you actually drill PITR + automated snapshots + manual snapshots + cross-region copy. Retention windows, the snapshot-during-failover gotcha, and the quarterly restore drill the team will hate until it saves them. The actual runbook, not the marketing diagram.
- Health check tuning for SaaS targets — what / actually means Default health check is /. The default catches a dead process, not a broken application. The path that matters talks to the database. The interval and threshold that matter prevent a slow target from killing the whole fleet.
- Redis session store on ElastiCache — the pattern that survives failover Stateless app + Redis sessions only works if the connection pool, TTL, key namespace, and failover behavior all line up. Here is the working pattern with connect-redis and iron-session config.
- Blue/green CodeDeploy on EC2 + ASG — the wait-and-shift mechanic that actually rolls back How CodeDeploy provisions a replacement ASG, holds it behind the ALB until validation passes, and tears down the old one — with the appspec.yml and deployment group config that make it work.
- Multi-AZ vs Multi-Region for RDS / Aurora — what the failover actually buys you Multi-AZ is sub-minute synchronous failover inside one region. Multi-Region is asynchronous replicas in a second region with a manual promote. The two solve different failure modes and most SaaS only needs one of them.
- CodeCommit IAM policies for team access — least-privilege per repo, branch-protected main CodeCommit's identity model is IAM, not user roles in a UI. Here are the policy patterns that give teams the right access per repo and block force-push on main.
- Cross-account CodeBuild — build once in CI, deploy to many environments Build artifacts in a shared CI account and deploy to per-environment accounts. IAM role assumption, KMS key sharing, ECR replication, S3 bucket policies — with real commands.
- VPC endpoints — gateway for S3 and DynamoDB, interface for everything else Gateway endpoints are free and cut S3 egress to zero. Interface endpoints are hourly but lower than NAT per GB. The DNS gotcha bites cross-account every time.
- buildspec.yml anatomy — every block in a production CodeBuild file A real production buildspec.yml dissected — phases, artifacts, reports, cache, env vars from Parameter Store and Secrets Manager. Every block explained.
- RDS Proxy in front of write-heavy Postgres or MySQL — when it cuts latency and when it adds it RDS Proxy solves the thundering-herd-after-failover and the Lambda connection-storm problems. It also adds 1–3ms per query and a layer to debug. Here is when it pays off, the exact config, and the IAM auth that bites you on day two.