Session 052 — Aurora: Serverless, Global Database and Differences vs Standard RDS
Aurora architecture with shared cluster volume, Aurora Serverless with ACU scaling, Global Database for cross-region DR, and fundamental differences vs standard RDS.
Session 051 — RDS: Multi-AZ, Read Replicas, RDS Proxy and Performance Insights
Multi-AZ DB Instance vs DB Cluster vs Read Replicas, RDS Proxy for connection pooling, Performance Insights and transition to CloudWatch Database Insights.
Session 050 — EKS: Karpenter — Dynamic Node Provisioning and NodePools
Karpenter architecture vs Cluster Autoscaler, Helm installation with IAM, NodePool and EC2NodeClass with instance constraints, automatic consolidation, and decision criteria for each approach.
Session 049 — EKS: Managed Add-ons — VPC CNI, CoreDNS and EBS CSI Driver
EKS managed add-ons with categories and field management, VPC CNI with Prefix Delegation, CoreDNS tuning, and EBS CSI Driver with IRSA for dynamic PersistentVolumes.
Session 048 — EKS: IRSA and Pod Identity — Workload-Level IAM Without Static Credentials
IRSA OIDC flow with ProjectedServiceAccountToken and STS AssumeRoleWithWebIdentity, EKS Pod Identity with add-on and ABAC session tags, and decision criteria for each approach.
Session 047 — EKS: Managed Node Groups vs Fargate, Upgrades and Node Drain
Managed node groups with labels and taints, Fargate Profiles with limitations, cluster version upgrade in order, 4 phases of node group update, and kubectl drain without downtime.
Session 046 — EKS: Cluster Provisioning with eksctl and VPC CNI Networking
eksctl ClusterConfig YAML, kubeconfig with aws eks update-kubeconfig, VPC CNI Secondary IP Mode and Prefix Delegation, pod density per instance type, and cluster verification.
Session 045 — SSM Parameter Store: Hierarchies, SecureString and Decision vs Secrets Manager
Hierarchies with get-parameters-by-path, String/StringList/SecureString types, Standard vs Advanced tiers, Parameter Policies, CDK dynamic references, and SSM vs Secrets Manager decision criteria.
Session 044 — Secrets Manager: Automatic Rotation, Lambda Rotators and RDS Integration
AWSPENDING/AWSCURRENT/AWSPREVIOUS version lifecycle, the 4 rotation function steps, Single User vs Alternating Users, native RDS rotation, custom rotator, and resilient applications.
Session 043 — AWS Budgets with Automatic Actions and Tagging Strategy for Chargeback
AWS Budgets with automatic actions (SCP, IAM, stop instances), mandatory tag hierarchy for chargeback, Tag Policies, AWS Config for compliance, and cost allocation models.
Session 042 — Cost Explorer, Cost Anomaly Detection and Compute Optimizer
GetCostAndUsage API with tag filters and AmortizedCost, Cost Anomaly Detection with monitors and thresholds, Compute Optimizer for EC2/Fargate rightsizing, and cost governance pipeline.
Session 041 — FinOps: Spot Instances, EC2 Fleet and Interruption Handling
Spot Instances with up to 90% discount, price-capacity-optimized allocation strategies, instance type diversification, interruption handling via IMDS and EventBridge, and Auto Scaling with mixed instances.
Session 040 — FinOps: Savings Plans vs Reserved Instances — differences and flexibility
Compute Savings Plans, EC2 Instance Savings Plans and Reserved Instances compared by flexibility, discount and risk. ROI calculation, break-even and over-commitment.
Session 039 — X-Ray: groups, annotations, sampling rules and cross-service integration
X-Ray Groups with filter expressions, sampling rules by endpoint, annotations vs metadata, distributed trace navigation ALB→Lambda→DynamoDB, and latency diagnosis.
Session 038 — CloudWatch: Composite Alarms, anomaly detection and automated actions
Composite Alarms with AND/OR/NOT logical expressions, anomaly detection with ML dynamic band, alarm actions with Lambda and SSM, and alarm states with missing data treatment.
Session 037 — CloudWatch Logs Insights: query syntax and derived fields
Logs Insights queries to aggregate errors by endpoint, extract fields with parse, timeseries with bin(), auto-discovered fields, and reusable saved queries.
Session 036 — CloudWatch: Custom Metrics with EMF (Embedded Metrics Format)
Custom metrics via EMF in Lambda without API calls, EMF document structure, EMF vs PutMetricData, high-resolution metrics, Powertools Metrics, and high-cardinality pitfalls.
Session 035 — DynamoDB Global Tables: eventual consistency and conflict resolution
Global Tables v2019 multi-region, last-writer-wins conflict resolution, MREC vs MRSC, rWRU/rWCU cost, DAX with Global Tables, and regional write patterns.
Session 034 — DynamoDB: transactions and conditional operations
Atomic TransactWriteItems with multiple entities, ConditionExpression for optimistic locking, 2x transaction cost, ClientRequestToken for idempotency, and isolation levels.
Session 033 — DAX: architecture, use cases and when NOT to use
DAX cluster architecture, item cache vs query cache, write-through, strongly consistent reads, node sizing, cost-benefit calculation, and patterns where DAX does not help.
Session 032 — DynamoDB Streams: Lambda integration for CDC and event-driven
DynamoDB Streams anatomy, delivery and ordering guarantees, Lambda event source mapping, event filtering, CDC pattern for OpenSearch, and fan-out to multiple consumers.
Session 031 — DynamoDB: GSIs and LSIs, hot partitions and write amplification
GSI with sparse index and write sharding, write amplification with multiple GSIs, GSI throttling back-pressure on base table, LSI vs GSI, and real index cost calculation.
Session 030 — DynamoDB: single-table design, adjacency list and overloaded indexes
Adjacency list for many-to-many, composite sort keys for hierarchies, GSI overloading for multiple access patterns, and when single-table creates more problems than it solves.
Session 029 — DynamoDB: access patterns first and generic PK/SK
Access patterns first paradigm, generic PK and SK with entity prefixes, item collections, GetItem and Query operations with begins_with and BETWEEN, and single-table design.
Session 028 — NLB and GLB: use cases, preserve client IP and inline inspection
NLB for TCP/UDP with static IP and PrivateLink, Gateway Load Balancer for inline inspection with GENEVE, preserve client IP by target type, and North-South topology with GLB.
Session 027 — ALB: native OIDC, mTLS and WAF integration
Native OIDC authentication on ALB with Cognito, mTLS with trust store for machine-to-machine, and WAF Web ACL with managed rules for L7 protection.
Session 026 — ALB: complex listener rules, weighted routing and fixed responses
Listener rules with multiple conditions (path + header + query string), weighted target groups for ALB canary releases, fixed response for health checks, and CDK/CLI deploy.
Session 025 — Lambda@Edge vs CloudFront Functions: use cases and limits
Choosing between Lambda@Edge and CloudFront Functions based on latency, body access, cost and deploy. Header injection, URL rewrite, JWT authentication at edge, and CDK deploy.
Session 024 — Lambda Observability: structured logging, X-Ray and Lambda Insights
Structured JSON logs with correlation fields, X-Ray active tracing with custom subsegments, Lambda Insights for per-invocation metrics, and correlation across all three pillars.
Session 023 — Step Functions: Parallel, Map, data flow between states and error handling
Parallel for concurrent branches, inline and distributed Map for iteration, InputPath/Parameters/ResultPath/OutputPath pipeline, and Retry with backoff + Catch by error type.
9 reference guides for anyone working with AWS Security
A practical collection on AWS security covering GuardDuty, Security Hub, IAM Privilege Escalation, Inspector, Config, Macie, CloudTrail, S3 Exfiltration and Threat Modeling.
Session 022 — Step Functions: Standard vs Express, basic states (Task, Choice, Wait) and execution
State machine with Task, Choice, Wait, Succeed and Fail, Standard vs Express Workflow guarantees, execution history for diagnostics, and integration patterns with Lambda and SQS.
Session 021 — Lambda: Extensions, Layers and Power Tools
Lambda Layers for shared dependencies, external Extensions in the Lambda lifecycle, and Powertools for structured logging, tracing and metrics with minimal code.
Session 020 — Lambda: event source mappings — SQS, Kinesis and DynamoDB Streams with filtering
Event source mapping for SQS with batch size and bisect-on-error, event filters to process only specific events, partial batch response, and retry and DLQ behavior per source.
Session 019 — Lambda: execution model, cold starts and provisioned concurrency
Execution environment lifecycle, cold start factors, Provisioned Concurrency, SnapStart for Java/.NET, and PC vs on-demand cost calculation.
Session 018 — ECS Observability: FireLens, Container Insights and X-Ray sidecar
FireLens with Fluent Bit for multi-destination log routing, enhanced Container Insights for per-task metrics, and X-Ray daemon as sidecar for distributed tracing.
Session 017 — ECS: Deploy strategies — rolling update and blue/green with CodeDeploy
ECS Service with CODE_DEPLOY deployment type, AppSpec for blue/green, test hooks after traffic shift, automatic rollback with CloudWatch Alarms, and canary/linear strategies.
Session 016 — ECS: Capacity Providers and Application Auto Scaling
Capacity Providers for Fargate and Fargate Spot with weights, Application Auto Scaling with custom metrics, backlog per task for SQS, and Spot cost savings calculation.
Session 015 — ECS Fargate: networking, security groups and IAM Roles for Tasks
Fargate awsvpc model with ENI per task, granular security groups, Task Role vs Execution Role, VPC endpoints for private subnets, and ECS Exec for debugging.
Session 014 — ECS: Services, service discovery and ALB Target Group integration
ECS Service with ALB Target Group, health checks with grace period, AWS Cloud Map for service-to-service discovery, and when to use each approach.
Session 013 — ECS: Task Definitions — containers, volumes, logging and resource limits
Complete task definition with multiple containers (sidecar pattern), awslogs driver for CloudWatch, EFS volumes, and CPU/memory limits per task vs per container.
Session 012 — CDK: Context, feature flags and production-grade cdk.json
Cached context lookups in cdk.context.json, feature flags to control migration behaviors, and cdk.json structure for teams with reproducible CI.
Session 011 — CDK: CustomResources and Aspects
CustomResource with Provider and AwsCustomResource to provision resources not natively supported, and Aspects to traverse and validate all constructs in a stack automatically.
Session 010 — CDK Pipelines: Custom Stages, ShellSteps and self-mutation in action
Sequential and parallel stages with Wave, validation ShellSteps between stages, envFromCfnOutputs, self-mutation in action, and debugging asset publishing failures.
Session 009 — CDK Pipelines: cross-account bootstrap, OIDC connection and pipeline structure
Cross-account bootstrap with --trust, CodeStar Connections with GitHub via OIDC, CDK Pipeline with Source + Build + UpdatePipeline, and self-mutation.
Session 008 — CDK: Testing with assertions — fine-grained and snapshot tests
Infrastructure unit tests with aws-cdk-lib/assertions, hasResourceProperties, matchers, Capture, snapshot tests and combined testing strategy.
Session 007 — CDK: Assets — Lambda bundling, Docker images and local files
Lambda deploy with bundled dependencies via NodejsFunction and PythonFunction, DockerImageFunction, and how assets are staged to S3/ECR by CDK.
Session 006 — CDK: Stacks, environments and multi-account patterns
Multiple stacks with distinct environments, Stage for multi-account, cross-stack references, and when to use stack per account vs nested stacks.
Session 005 — CDK: Constructs L1, L2, L3 — what they are and how to choose
Distinction between L1 (CfnBucket), L2 (Bucket) and L3 (patterns) constructs, escape hatches, Construct Hub, and when each level is appropriate.
Session 004 — CDK v2: setup, bootstrap and project structure
CDK v2 project initialization in TypeScript/Python, cdk bootstrap, construct structure, and cdk synth, cdk diff and cdk deploy commands.
Session 003 — CloudFormation: changesets, drift detection and stack policies
Changesets to review changes before applying, drift detection to find divergences, and stack policies to protect critical resources from accidental replacement.
Session 002 — CloudFormation: stacks, templates, parameters, outputs, Ref/GetAtt
Complete YAML template with typed Parameters, Resources with Ref and Fn::GetAtt, Outputs exported across stacks, and deploy via aws cloudformation deploy with changesets.
Session 001 — Advanced AWS CLI: SSO, profiles, assume-role and pagination
SSO profile configuration with IAM Identity Center, assume-role for cross-account context switching, pagination with --page-size and --max-items, and filtering with --query and JMESPath.
Amazon ECS Managed Daemons: independent agent control in your cluster
Deep dive into Amazon ECS Managed Daemons, a new feature that lets you manage monitoring, logging and security agents independently from applications on ECS Managed Instances.
SQS Admin Panel: a serverless panel to manage SQS queues
Meet SQS Admin Panel, a 100% serverless web panel to manage Amazon SQS queues with dashboard, DLQ redrive, export/import and one-command deploy.
Arch CLI: the Swiss Army Knife for Architecture, SRE and DevOps Teams on AWS
Deep dive into Arch CLI, an open source tool that centralizes AWS account management with security auditing, FinOps, containers, monitoring and AI-powered analysis.
AWS IAM Policy Autopilot: creating IAM policies straight from Kiro
Deep dive into AWS IAM Policy Autopilot, an open source tool that now works as a Kiro Power to automatically generate IAM policies from your code.
Using Sub Agents with Kiro CLI
Deep dive into sub agents in Kiro CLI: how they work, when to use them, orchestration patterns and practical examples to speed up your workflow.
The biggest lesson from AWS re:Invent 2025
A reflection on the purpose of technology and the Renaissance Developer concept presented by Werner Vogels at AWS re:Invent 2025.
Exploring Amazon GuardDuty ETD in Practice
Understand GuardDuty Extended Threat Detection (ETD), see examples of AttackSequence findings, and implement automated responses with EventBridge + Lambda.
Mastering DevSecOps in AWS: Policies-as-Code, SAST and Integrated Observability
Complete guide on DevSecOps in AWS: Policies-as-Code with CloudFormation Guard and OPA, SAST with Amazon Inspector Code, and observability with CloudWatch and X-Ray.
Amazon Inspector Code Security: Shift Left and Native SAST on AWS
Learn how the new Amazon Inspector code analysis feature lets you detect vulnerabilities directly in your repository, using SAST techniques integrated into AWS DevSecOps.
How to mitigate attacks on code agents in AWS
Strategies to prevent, detect and respond to attacks like Rules File Backdoor affecting Copilot/Cursor
How to Mitigate Ransomware Attacks on AWS
Comprehensive strategies to prevent, detect, and respond to ransomware attacks in AWS environments
Strategies to Mitigate Exfiltration Attacks on Amazon S3
Complete guide to protecting S3 data against exfiltration attacks using only AWS services
Amazon Inspector: Basic Concepts
Complete guide on Amazon Inspector: configuration, findings management, and best practices
AWS IAM Identity Center: From Basics to Advanced
Complete guide on AWS IAM Identity Center (SSO): configuration, IdP integration, and best practices
Getting to Know Prowler Open Source
Complete guide on Prowler: an open source tool for security auditing and compliance in AWS
Key Security Points for Provisioning an Application on Amazon ECS and Amazon EKS
Complete container security guide: comparison between ECS and EKS with best practices
Open Source Software to Strengthen Security on AWS
Complete guide to open source tools for reinforcing security in AWS environments: IDS/IPS, containers, SIEM and more
Amazon GuardDuty DeepDive: Advanced Threat Detection on AWS
Complete guide on Amazon GuardDuty: advanced features, multi-account integration, and response automation
Amazon ECS Details
Advanced guide on Amazon ECS: clusters, task definitions, security, observability, and high availability
AWS - Support Repository
Collaborative repository with practical examples and configurations for AWS
Top Security Announcements at AWS re:Invent 2024
Summary of the top security announcements at AWS re:Invent 2024