Who is Fernando F. Azevedo?

Fernando F. Azevedo is a Senior Solutions Architect at Banco Itaú with 16+ years of experience across AWS, event-driven architecture, DevSecOps, Data Mesh, AI and financial systems.

What technical topics does Fernando work with?

Fernando works with AWS, Kubernetes, Kafka, Data Mesh, Amazon Bedrock, RAG, DevSecOps, observability, financial systems and architecture communication using C4, ADRs and trade-off analysis.

Is Fernando available for professional conversations?

Fernando is currently building at Banco Itaú and is open to thoughtful conversations about architecture, cloud, AI, engineering leadership, community, podcasts and technical collaboration.

Insights

Architecture field notes

Architecture, cloud and applied AI blog

Deep analysis on solution architecture, AWS, AI, security, data and financial technology through a critical-systems lens.

Tracks

Solution Architecture3 articles AWS & Cloud6 articles AI & Agents53 articles Security & Resilience8 articles Data Platforms7 articles Financial Systems4 articles

Browse guided learning paths

Migrating to Native Git in SageMaker Unified Studio

SageMaker Unified Studio replaced the automatic sync model with flexible, file-level Git version control spanning Query Editor, Visual ETL, Workflows, and Notebooks in a unified experience. For teams in regulated environments, this change is not cosmetic — it redefines auditability, artifact traceability, and the governance model for analytical code. In this article, I walk through the migration journey, the real risks, and the architecture decisions that matter in production.

Jul 31, 2026 9 minadvanced

Read full analysis

Technical picks

Deep technical reading

AI & AgentsPattern Teardown

AutoScalingInstanceRefresh in CloudFormation: Pattern Teardown

The integration of Instance Refresh as a native CloudFormation update policy closes an operational gap that forced teams to orchestrate AMI deployments outside the IaC lifecycle. In this article, I dissect the pattern's anatomy, its real failure modes, and when it is — and is not — the right choice for high-criticality environments.

ec2-auto-scalingcloudformationinstance-refresh

Jul 30, 2026 9 minadvanced

AI & AgentsDecision Record

ADR: EKS Provisioned Control Plane and 40x HPA Concurrency

EKS Provisioned Control Plane now processes HPA objects with up to 40x more concurrency than the Kubernetes default, eliminating a silent bottleneck in clusters running hundreds of workloads. In this architecture decision record, I analyze the context that makes this change meaningful, the options that existed before it, and the operational consequences architects need to address now.

ekskuberneteshpa

Jul 29, 2026 9 minadvanced

AI & AgentsComparison

TBAC vs Explicit ARN vs SCP vs VPC Isolation in Neptune

Neptune now supports Tag-Based Access Control (TBAC) for IAM, adding a fourth access control model to a service that already offered VPC isolation, IAM authentication with explicit ARNs, and Service Control Policies. Choosing the right model — or the right combination — has direct implications for security posture, team onboarding velocity, and operational cost in financial data platforms.

neptuneiamtbac

Jul 28, 2026 9 minadvanced

Latest articles

AI & AgentsTechnology Review

Amazon Connect + AVD/Windows 365: Audio Optimization in VDI

AWS announced Amazon Connect audio optimization support for Azure Virtual Desktop (AVD) and Windows 365 Cloud PC via Microsoft Multimedia Redirection (MMR), extending a capability already present for WorkSpaces, Citrix, and Omnissa. The mechanism redirects media processing from the session host to the agent's local device, reducing latency and improving voice quality in heterogeneous VDI environments. In this article, I assess what this feature actually delivers, where it falls short, and how to integrate it into financial-grade contact center architectures.

amazon-connectvdiazure-virtual-desktopwindows-365webrtc

Jul 27, 2026 13 minintermediate

VDI Media Redirection in Amazon Connect: How It Really Works

Amazon Connect's support for Azure Virtual Desktop and Windows 365 via Microsoft Multimedia Redirection looks simple on the surface, but it hides a media routing decision chain with serious implications for latency, security, and compliance. In this article I dissect the mechanism layer by layer, expose the failure modes the documentation doesn't mention, and offer a design model for high-demand financial environments.

amazon-connectvdiwebrtcazure-virtual-desktopmedia-redirection

Jul 26, 2026 10 minadvanced

AI & AgentsField Notes

Amazon Connect + AVD: VDI Audio Optimization in Financial-Grade Environments

Amazon Connect's native media redirection support for Azure Virtual Desktop and Windows 365 Cloud PC closes a critical operational gap in financial contact centers that have already migrated agents to hybrid VDI. The mechanism uses Microsoft Multimedia Redirection (MMR) to offload WebRTC audio processing from the session host to the agent's local device — reducing perceived latency and eliminating the double-encoding that degrades voice quality. This article details what changes architecturally, the deployment gotchas, and an actionable checklist for platform teams.

amazon-connectvdiazure-virtual-desktopaudio-optimizationcontact-center

Jul 25, 2026 11 minadvanced

AI & AgentsTrend Briefing

Zone-Aware Routing in ECS Service Connect: The End of the Cost vs. Resilience Trade-off

ECS Service Connect gained zone-aware routing in July 2026, automatically preferring same-AZ endpoints without additional code. For financial architectures with high-frequency service-to-service calls, this materially changes the economics of multi-AZ design. In this article, I analyze the mechanism, real trade-offs, and how to position this feature in payment platforms and real-time data systems.

ECSService ConnectZone-Aware RoutingMulti-AZFinTech

Jul 24, 2026 10 minadvanced

AI & AgentsIncident Retro

C7a in us-west-1: Migration Retro and Production Resilience

The EC2 C7a landing in us-west-1 in July 2026 looks trivial — one more region, one more instance type. But for teams running compute-intensive workloads under tight SLOs, every regional expansion carries real migration risks that rarely surface in announcements. In this retro, I analyze what can (and usually does) go wrong, the systemic root cause, and how to build the right remediation.

ec2c7aamd-epycmigrationresilience

Jul 23, 2026 10 minadvanced

AI & AgentsMigration Story

Migrating High-Network Workloads to EC2 R6in/R6idn in Paris and Canada

The availability of R6in and R6idn instances in Europe (Paris) and Canada (Central) in July 2026 closes a critical data-residency gap for financial-grade and real-time analytics workloads. This article narrates the migration journey from R5n to R6in/R6idn instances, detailing architecture decisions, operational risks, and the measurable network and IOPS gains that justify the move.

ec2r6inmigrationfinancial-gradenetworking

Jul 22, 2026 10 minadvanced