The path· 53
- 1Intermediate 5 minThe IDE Became the Exception: How I Shifted to Building Loops Instead of CodeAfter 16 years building financial-grade systems on AWS, I realized my job changed: I no longer design code line by line, I design loops — triggers, topologies, verifiers, and stop-rules. The IDE still exists on my workbench, but less and less. This post is the honest record of that transition.
- 2Intermediate 10 minAWS Builder Center Sandboxes: Technical Review and Architecture AnalysisAWS Builder Center now offers free, time-limited sandbox environments directly within workshops, removing the need for a personal account or credit card. The proposition is solid for onboarding and controlled experimentation, but there are operational and governance limits that engineering teams need to understand before integrating this resource into enablement tracks. This is an honest technical review focused on isolation, lifecycle, adoption patterns, and where the offering still falls short.
- 3Intermediate 8 minIAM Roles for Stream Sessions: A Credential Strategy Bake-OffIAM role support for Amazon GameLift Streams sessions, launched in July 2026, eliminates the need for long-lived access keys in streaming applications. In this article I compare the four available credential approaches — static keys, environment variables, AWS Secrets Manager, and IAM roles via RoleArn — using security, operational complexity, cost, and auditability as axes. The conclusion is straightforward: IAM roles wins on nearly every dimension that matters in production environments.
- 4Intermediate 13 minAmazon Connect + AVD/Windows 365: Audio Optimization in VDIAWS announced Amazon Connect audio optimization support for Azure Virtual Desktop (AVD) and Windows 365 Cloud PC via Microsoft Multimedia Redirection (MMR), extending a capability already present for WorkSpaces, Citrix, and Omnissa. The mechanism redirects media processing from the session host to the agent's local device, reducing latency and improving voice quality in heterogeneous VDI environments. In this article, I assess what this feature actually delivers, where it falls short, and how to integrate it into financial-grade contact center architectures.
- 5Advanced 11 minTPU Developer Hub: A Technical Review of a High-Performance AI PlatformThe TPU Developer Hub consolidates tooling, documentation, and high-performance ML stacks around Google Cloud TPUs. For architects operating in financial-grade environments with latency, cost, and governance demands, understanding where this platform delivers real value — and where it imposes operational friction — is essential before any migration commitment.
- 6Advanced 8 minAgent Evaluation as an Engineering DisciplineAI agent evaluation has moved beyond ad hoc prompt engineering into a full engineering discipline with versioned datasets, automated quality gates, and regression traceability. Bedrock AgentCore materializes that shift by bringing managed infrastructure to the agent testing lifecycle. For financial-grade systems architects, this changes the contract between ML teams and platform engineering.
- 7Advanced 12 minDocument Automation with Bedrock: A Modernization JourneyLegacy document extraction pipelines in financial environments accumulate silent technical debt: brittle OCR, manual rules, and absent traceability. In this article, I narrate the modernization journey to Bedrock Data Automation, covering architecture decisions, managed risks, and what genuinely changes in operations. The analysis is grounded in real patterns from critical financial systems, not lab demos.
- 8Advanced 10 minWeb Search on Bedrock AgentCore: An In-Depth Technical ReviewWeb Search on Amazon Bedrock AgentCore delivers managed web search for AI agents, with zero data egress outside the AWS environment and MCP-based grounding. I review the capability with a senior architect's critical eye: real trade-offs, operational limits, and when adoption actually makes sense.
- 9Advanced 8 minInvokeGuardrailChecks vs Classic Guardrails: Which to Use in AI Agents?AWS released the InvokeGuardrailChecks API in Amazon Bedrock Guardrails — a resourceless API that lets you apply individual safeguards at any point in an agentic loop without creating or versioning guardrail resources. In this article, I run a direct head-to-head between this approach and classic resource-based Guardrails, evaluating latency, governance, cost, and fitness for financial-grade mission-critical systems.
- 10Advanced 11 minAmazon Bedrock AgentCore: Continuous Agent Optimization in ProductionAmazon Bedrock AgentCore introduces a continuous improvement loop that turns production traces into actionable diagnostics, data-grounded recommendations, and statistical validation via A/B testing. For architects of financial systems and high-stakes platforms, this represents AWS's first serious attempt to close the gap between agent observability and reliable production operation.
- 11Advanced 9 minManaged Syslog Ingestion in CloudWatch: Anatomy of a PatternCloudWatch Logs now accepts syslog directly via VPC endpoint — no agents, with automatic parsing of RFC 5424, RFC 3164, and Cisco FTD/ASA. This shifts the log collection pattern for network devices and Linux servers in regulated environments. In this article, I dissect the pattern anatomy, its real limits, and the anti-patterns I've seen burn teams in production.
- 12Advanced 9 minAmazon Bedrock AgentCore Harness: From Idea to Production-Grade AgentAgentCore Harness reached GA in June 2026 as a managed abstraction that collapses the LLM agent control plane into two API calls. In this article, I analyze how the harness works internally, where it fails, and what architects of financial-grade systems need to understand before putting it into production.
- 13Advanced 10 minAMI Watermarks: Image Governance at Financial-Grade ScaleAMI Watermarks arrive in EC2 as a provenance primitive that persists across cross-region copies, cross-account sharing, and new AMI creation from running instances. For financial environments with hundreds of accounts and dozens of regions, this solves a problem that tag scripts and SCPs partially addressed — but never reliably. In this article, I walk through the migration journey from an ad hoc model to an auditable chain of custody.
- 14Advanced 10 minC7a in Singapore: A Migration Incident Retro for Financial-Grade SystemsThe EC2 C7a landing in Asia Pacific (Singapore) on June 25, 2026 is not just a hardware announcement — it is a migration trigger with real traps for teams running low-latency financial workloads in the region. In this retro, I walk through what happens when teams migrate from C6a to C7a without proper preparation: from EBS volume limit surprises to performance regressions caused by NUMA misconfiguration. I close with a concrete set of resilience changes I would apply immediately.
- 15Advanced 8 minGraviton4 R8g: Global Expansion and What Changes for Memory-Intensive ArchitecturesAWS has expanded EC2 R8g Graviton4 instances to five new regions — Thailand, New Zealand, South Africa, Italy, and Canada West — completing a global rollout that reshapes the cost-performance equation for memory-intensive workloads outside major hubs. With up to 1.5 TB RAM, 48xlarge sizing, and 40% database gains over Graviton3, this is not an incremental upgrade. It is a platform maturity signal that changes architecture decisions in regions where instance choice was previously constrained.
- 16Advanced 9 minEC2 R8g in New Regions: Migration Field Guide for Financial WorkloadsThe expansion of EC2 R8g instances to Thailand, New Zealand, Cape Town, Milan, and Calgary is far more than a regional availability note — it is an architecture decision with direct implications for latency, data compliance, and operational cost. In this article, I document what I learned migrating memory-intensive financial workloads from R7g to R8g, including the gotchas that never appear in the official docs.
- 17Advanced 8 minEC2 R8g and Graviton4: A Technical Deep Dive for Memory-Intensive WorkloadsEC2 R8g instances powered by Graviton4 are now available in regions including Africa (Cape Town), Europe (Milan), and Asia Pacific (Thailand, New Zealand), delivering up to 1.5 TB of memory and 3x more vCPUs than the previous generation. In this article, I analyze the real mechanisms behind this performance leap, the migration trade-offs, and the design patterns that make these instances relevant for critical financial-grade systems.
- 18Advanced 12 minAWS WAF on AgentCore Gateway: Production Security for Agentic AIThe general availability of AWS WAF for Amazon Bedrock AgentCore Gateway marks an important inflection point: agentic AI workloads can now receive consistent edge protections without per-agent instrumentation. I analyze what this integration actually delivers, where it still leaves gaps, and how to build a mature security posture for agentic systems in production.
- 19Advanced 9 minCloudWatch Logs Tag Enrichment vs. Alternative ApproachesCloudWatch Logs now enriches log events with resource tags at ingestion time, at no extra cost and without instrumentation changes. But does this replace custom enrichment pipelines, OpenTelemetry-based approaches, or third-party solutions like Datadog? I do an honest trade-off analysis for teams running financial-grade systems on AWS.
- 20Advanced 7 minIaC for AI Platforms: Terraform and SageMaker Unified StudioOfficial Terraform support for SageMaker Unified Studio closes a critical gap: AI platforms can now be provisioned with the same IaC rigor applied to networks and databases. In this article I dissect the pattern, its modular anatomy, when it solves the right problem, and when it conceals dangerous technical debt.
- 21Advanced 12 minSageMaker Unified Studio via Terraform: Migrating to IaC in Financial-Grade EnvironmentsTerraform support for Amazon SageMaker Unified Studio, announced in July 2026, closes a critical gap for data platforms in regulated environments: ML domains that previously required ClickOps or brittle SDK automation can now be versioned, reviewed, and promoted like any other infrastructure resource. In this article, I analyze the migration journey from a console-driven initial state to a full IaC pipeline, with particular attention to the IAM pitfalls, blueprint governance, and operational observability that make the difference in financial-grade environments.
- 22Advanced 10 minSageMaker Unified Studio + Terraform: IaC for AI Platforms Incident RetroThe absence of reproducible infrastructure-as-code for unified AI platforms is not a convenience problem — it is a vector for governance incidents, configuration drift, and audit failures in financial-grade environments. Terraform support for Amazon SageMaker Unified Studio, launched in July 2026, closes a critical gap I have seen cause real incidents at multiple enterprise customers. This retro analyzes the failure pattern, the typical timeline, and the resilience changes that must follow.
- 23Advanced 8 minSageMaker Unified Studio + Terraform: IaC for Financial-Grade AI PlatformsThe official Terraform support for SageMaker Unified Studio, launched in July 2026, closes a critical gap for platform teams operating in regulated financial environments: the ability to version, audit, and promote AI/data domains with the same rigor applied to any other infrastructure resource. This briefing analyzes what changes in practice, where the real risks lie, and how to position this capability within an Internal Developer Platform strategy.
- 24Advanced 9 minGameLift Streams Admin Shell: Secure Live-Session Access Without SSHAmazon GameLift Streams now provides secure terminal access to live sessions via SSM Session Manager — no SSH, no open ports, no infrastructure credentials. This mechanism has serious architectural implications for teams operating streaming platforms at scale, particularly around audit trails, blast radius, and ephemeral access control. I analyze how the feature works internally, where it can fail, and how to integrate it safely in financially critical environments.
- 25Advanced 10 minR8i: Anatomy of an Instance Family for I/O-Intensive WorkloadsThe R8i family lands in Tokyo, Frankfurt, and Ireland with 600 Gbps network bandwidth and 300 Gbps EBS bandwidth — the highest figures among non-accelerated EC2 instances. Before migrating critical workloads, it is worth dissecting the anatomy of these four variants, understanding the real trade-offs, and knowing precisely when this family solves the problem and when it is the wrong choice.
- 26Advanced 10 minDRS + EBS Initialization Rate: Predictable RTO in Financial-Grade EnvironmentsAWS Elastic Disaster Recovery now supports EBS Provisioned Rate for Volume Initialization, eliminating storage performance variability from the critical RTO path. For financial systems architects, this shifts the conversation from 'we hope the volume initializes in time' to 'we know exactly when storage will reach full performance'. The signal is small on the surface, but the impact on DR design is substantial.
- 27Advanced 9 minCloudWatch Logs Intelligent Tiering: Field Guide for Financial-Grade EnvironmentsCloudWatch Logs Intelligent Tiering arrived in July 2026 promising lower log retention costs without operational overhead — but for financial-grade environments with audit requirements, the story is more nuanced. In this field note, I analyze the three tiers, the automatic transition thresholds, and where this feature genuinely delivers value versus where it can create unpleasant surprises.
- 28Advanced 9 minAmazon Managed Grafana FedRAMP High: Observability in Regulated EnvironmentsAmazon Managed Grafana has achieved FedRAMP High authorization in AWS GovCloud (US-East) and (US-West) regions, unlocking managed observability for federal agencies and sectors with strict compliance requirements. In this article, I analyze what that authorization actually means architecturally, the design patterns it enables, and the anti-patterns that persist even with an authorized service.
- 29Advanced 10 minIAM Roles for GameLift Streams: The End of Embedded CredentialsAmazon GameLift Streams now supports IAM roles for stream sessions, eliminating the need for long-lived credentials embedded in application bundles or passed as environment variables. The change aligns the service with the same container credential provider mechanism already trusted by ECS and EKS — with no application code changes required. In this article, I analyze what this feature actually delivers, where meaningful limits remain, and how to adopt it rigorously in production environments.
- 30Advanced 9 minADR: IAM Role Sessions in GameLift Streams — Eliminating Static CredentialsAmazon GameLift Streams added per-session IAM role support in July 2026, eliminating the need for static credentials embedded in application bundles. This article analyzes the architectural decision behind this change, the security patterns it embodies, and the operational consequences for teams building streaming platforms with AWS resource access.
- 31Advanced 9 minFinOps for Generative AI: Dissecting the Bedrock Cost Pattern in CUR 2.0With standardized Bedrock metadata now available in AWS Data Exports, generative AI cost attribution no longer depends on brittle free-text field parsing — it gains native structure in CUR 2.0. In this article, I dissect the anatomy of this pattern, the scenarios where it genuinely solves the problem, and the failure modes that persist when AI governance is not aligned with the FinOps pipeline.
- 32Advanced 10 minMigrating High-Network Workloads to EC2 R6in/R6idn in Paris and CanadaThe availability of R6in and R6idn instances in Europe (Paris) and Canada (Central) in July 2026 closes a critical data-residency gap for financial-grade and real-time analytics workloads. This article narrates the migration journey from R5n to R6in/R6idn instances, detailing architecture decisions, operational risks, and the measurable network and IOPS gains that justify the move.
- 33Advanced 10 minC7a in us-west-1: Migration Retro and Production ResilienceThe EC2 C7a landing in us-west-1 in July 2026 looks trivial — one more region, one more instance type. But for teams running compute-intensive workloads under tight SLOs, every regional expansion carries real migration risks that rarely surface in announcements. In this retro, I analyze what can (and usually does) go wrong, the systemic root cause, and how to build the right remediation.
- 34Advanced 10 minZone-Aware Routing in ECS Service Connect: The End of the Cost vs. Resilience Trade-offECS Service Connect gained zone-aware routing in July 2026, automatically preferring same-AZ endpoints without additional code. For financial architectures with high-frequency service-to-service calls, this materially changes the economics of multi-AZ design. In this article, I analyze the mechanism, real trade-offs, and how to position this feature in payment platforms and real-time data systems.
- 35Advanced 11 minAmazon Connect + AVD: VDI Audio Optimization in Financial-Grade EnvironmentsAmazon Connect's native media redirection support for Azure Virtual Desktop and Windows 365 Cloud PC closes a critical operational gap in financial contact centers that have already migrated agents to hybrid VDI. The mechanism uses Microsoft Multimedia Redirection (MMR) to offload WebRTC audio processing from the session host to the agent's local device — reducing perceived latency and eliminating the double-encoding that degrades voice quality. This article details what changes architecturally, the deployment gotchas, and an actionable checklist for platform teams.
- 36Advanced 10 minVDI Media Redirection in Amazon Connect: How It Really WorksAmazon Connect's support for Azure Virtual Desktop and Windows 365 via Microsoft Multimedia Redirection looks simple on the surface, but it hides a media routing decision chain with serious implications for latency, security, and compliance. In this article I dissect the mechanism layer by layer, expose the failure modes the documentation doesn't mention, and offer a design model for high-demand financial environments.
- 37Advanced 9 minTBAC vs Explicit ARN vs SCP vs VPC Isolation in NeptuneNeptune now supports Tag-Based Access Control (TBAC) for IAM, adding a fourth access control model to a service that already offered VPC isolation, IAM authentication with explicit ARNs, and Service Control Policies. Choosing the right model — or the right combination — has direct implications for security posture, team onboarding velocity, and operational cost in financial data platforms.
- 38Advanced 9 minADR: EKS Provisioned Control Plane and 40x HPA ConcurrencyEKS Provisioned Control Plane now processes HPA objects with up to 40x more concurrency than the Kubernetes default, eliminating a silent bottleneck in clusters running hundreds of workloads. In this architecture decision record, I analyze the context that makes this change meaningful, the options that existed before it, and the operational consequences architects need to address now.
- 39Advanced 9 minAutoScalingInstanceRefresh in CloudFormation: Pattern TeardownThe integration of Instance Refresh as a native CloudFormation update policy closes an operational gap that forced teams to orchestrate AMI deployments outside the IaC lifecycle. In this article, I dissect the pattern's anatomy, its real failure modes, and when it is — and is not — the right choice for high-criticality environments.
- 40Advanced 9 minMigrating to Native Git in SageMaker Unified StudioSageMaker Unified Studio replaced the automatic sync model with flexible, file-level Git version control spanning Query Editor, Visual ETL, Workflows, and Notebooks in a unified experience. For teams in regulated environments, this change is not cosmetic — it redefines auditability, artifact traceability, and the governance model for analytical code. In this article, I walk through the migration journey, the real risks, and the architecture decisions that matter in production.
- 41Expert 7 minGPT-5 vs Claude vs Nova on Bedrock: A Production Governance Bake-offWith GPT-5.5 and Codex landing on Amazon Bedrock, platform teams now face a genuine choice between three frontier model families within the same control plane. This analysis compares GPT-5.5, Claude 3.7 Sonnet, and Amazon Nova Pro through the lens of teams shipping AI into regulated production environments.
- 42Expert 9 minADR: Adopting Amazon Bedrock AgentCore in ProductionBedrock AgentCore promises to reduce the operational friction of running AI agents in production, but adopting any managed agent orchestration platform demands an explicit architectural decision. In this ADR, I document the forces that drove me to evaluate AgentCore, the alternatives considered, and the real consequences of each path.
- 43Expert 9 minEC2 G7e: Architecture Decision for Generative Video InferenceEC2 G7e instances arrive with NVIDIA L40S GPUs and promise to redefine cost-per-frame for generative video inference workloads. In this architecture decision record, I evaluate the forces that make this choice non-trivial, the failure patterns I have seen in production, and the configuration I would adopt in a financial-grade environment.
- 44Expert 8 minContract Intelligence on AWS: Field-Notes ArchitectureBuilding contract intelligence with generative AI goes far beyond wiring an LLM to PDFs. This article documents the architectural patterns, operational gotchas, and design decisions that separate an impressive PoC from a reliable system in financial-grade production.
- 45Expert 8 minAgentic RAG on AWS: Architecture Bake-Off for Financial-Grade PlatformsAgentic RAG has moved from lab experiment to platform requirement in financial environments that demand auditability, cost control, and predictable latency. In this article I compare four concrete architectural approaches on AWS, with real trade-offs, plausible numbers, and an unambiguous recommendation.
- 46Expert 9 minBedrock Managed Knowledge Base: Anatomy of a Managed RAG PipelineAmazon Bedrock Managed Knowledge Base abstracts the entire RAG stack — connectors, parsing, embeddings, re-ranking, and agentic retrieval — into a single managed primitive. In this article, I disassemble each layer, expose the failure modes the documentation doesn't mention, and analyze the real trade-offs for engineers designing financial-grade AI systems on AWS.
- 47Expert 9 minSecure Multi-Tenant RAG: ADR for Two-Layer AuthorizationAuthorization in multi-tenant RAG is not an implementation detail — it is an architectural decision with direct consequences for compliance, cross-tenant data leakage, and LLM attack surface. In this ADR, I document the forces that led me to adopt a defense-in-depth pattern with Amazon Verified Permissions and Bedrock Knowledge Bases, the alternatives I discarded, and the operational consequences that must be managed.
- 48Expert 9 minADR: Scaling Agents to Production with AgentCore Runtime QuotasIn July 2026, AWS raised AgentCore Runtime default limits to 5,000 active concurrent sessions in us-east-1/us-west-2 and 200 interactions per second across all regions. This ADR documents the context that forced this design decision, the architectural options I evaluated for financial-grade agentic systems at scale, and the operational consequences you must plan for before putting agents into production.
- 49Expert 10 minDPD on HyperPod: Disaggregated Prefill and Decode in ProductionSageMaker HyperPod now supports Disaggregated Prefill and Decode (DPD), separating the two LLM inference phases onto dedicated GPU pools connected via EFA and GPU-Direct RDMA. This change resolves one of the most persistent production problems: a single long-context request degrading per-token latency for every concurrent request. In this article, I analyze the real trade-offs, the failure modes you will encounter, and a playbook for enabling DPD on demanding financial-grade workloads.
- 50Expert 10 minOAuth on AWS MCP Server: Auth Strategy Bake-Off for AI AgentsNative OAuth support on the AWS MCP Server changes the game for teams that were improvising agent authentication with static credentials or custom Cognito flows. But 'OAuth support' is not an architecture decision — it is a starting point. In this article, I run an honest bake-off across four authentication strategies for AI agents in financial-grade environments, with real trade-offs, plausible numbers, and a direct recommendation.
- 51Expert 10 minADR: Migrating Financial Workloads to EC2 R8i in Tokyo and FrankfurtThe availability of EC2 R8in, R8ib, R8idn, and R8idb instances in Tokyo, Frankfurt, and Ireland opens a real decision window for financial architectures that depend on sub-millisecond network latency, extreme EBS throughput, and data residency compliance. This ADR documents the reasoning behind adopting — or not — these instances for financial-grade workloads.
- 52Expert 12 minMigrating Financial Workloads to EC2 R8i: Decisions and Trade-offsThe July 2026 availability of EC2 R8i instances (R8in, R8ib, R8idn, R8idb) in Tokyo, Frankfurt and Ireland opens a concrete modernization window for financial platforms still running on R6i/R6in — generations with real network bandwidth and EBS throughput ceilings. This article narrates the migration journey as a sequence of architecture decisions, with risks managed at each step and the numbers that justify the move.
- 53Expert 9 minGPT-5.6 on Bedrock: Adoption Retro for Financial-Grade EnvironmentsThe July 13, 2026 launch of GPT-5.6 Sol, Terra, and Luna on Amazon Bedrock exposed rushed adoption patterns I have seen repeatedly in regulated financial environments. This retro examines what happens when engineering teams integrate third-party models via Bedrock without adequate governance controls — and how to correct course before the next incident occurs.
Deep-dive studies
tutorialSAP LeanIX in Practice: The Architect's Guide — Inventory, Diagrams, and ReportsA practical, opinionated tutorial on using SAP LeanIX as a transformation accelerator in the architect's daily work — covering inventory (Fact Sheets, meta model, quality), diagrams (types, when to use, live vs static), and reports (question → data → decision). Uses Hohpe's Architecture Elevator as the connecting thread and a fictional insurer/bank scenario to make every concept concrete.guideLoop Engineering: designing the loops that guide AI agentsThe bottleneck in AI agents has shifted from the prompt sentence to the loop design: trigger, topology, verifier, and stop rules. This guide teaches loop engineering fundamentals — from the base ReAct loop to a pattern catalogue — with real examples from my own system and a step-by-step guide for engineering any loop safely.guideLambda vs ECS: the architect's compute decision guide on AWSChoosing between Lambda and ECS is not about preference — it is about matching the unit of scale to the load pattern. This guide covers every Lambda type (including MicroVMs and Managed Instances) and ECS type (Fargate, EC2, Managed Instances), the decision framework I use in practice, and the real impact on engineering, business, and customer experience.playbookPlaybook: 5 AI Architecture Shifts — and what to do about each oneWhat was advanced in 2025 became default in 2026: the bottleneck moved past the prompt, agents went to managed production, MCP standardized tooling, security became layered, and token FinOps entered the roadmap. This playbook maps each shift to concrete actions — for people building systems, not demos.guideInside AI Agents (1/3): Anatomy and the Reasoning LoopA technical lesson for developers and architects who hear 'AI agent' every day but want to truly understand what differentiates an agent from a plain LLM, a fixed pipeline, or simple RAG. We cover the full anatomy — model, tools, memory, planner — and the ReAct loop step by step with a concrete example. No hype; real trade-offs.guideInside AI Agents (2/3): Architecture Pattern Catalog — from ReAct to Multi-AgentThe second lesson in the series maps the full catalog of AI agent architecture patterns: from single-agent loops (ReAct, Reflexion, Plan-and-Execute) to multi-agent orchestration, covering memory as an architecture decision, guardrails, and human-in-the-loop. The goal is to give the architect a precise vocabulary to choose — and justify — the right pattern for each problem, without falling into classic anti-patterns.