The path· 83
- 1Intermediate 5 minThe IDE Became the Exception: How I Shifted to Building Loops Instead of CodeAfter 16 years building financial-grade systems on AWS, I realized my job changed: I no longer design code line by line, I design loops — triggers, topologies, verifiers, and stop-rules. The IDE still exists on my workbench, but less and less. This post is the honest record of that transition.
- 2Intermediate 10 minAWS Builder Center Sandboxes: Technical Review and Architecture AnalysisAWS Builder Center now offers free, time-limited sandbox environments directly within workshops, removing the need for a personal account or credit card. The proposition is solid for onboarding and controlled experimentation, but there are operational and governance limits that engineering teams need to understand before integrating this resource into enablement tracks. This is an honest technical review focused on isolation, lifecycle, adoption patterns, and where the offering still falls short.
- 3Intermediate 8 minIAM Roles for Stream Sessions: A Credential Strategy Bake-OffIAM role support for Amazon GameLift Streams sessions, launched in July 2026, eliminates the need for long-lived access keys in streaming applications. In this article I compare the four available credential approaches — static keys, environment variables, AWS Secrets Manager, and IAM roles via RoleArn — using security, operational complexity, cost, and auditability as axes. The conclusion is straightforward: IAM roles wins on nearly every dimension that matters in production environments.
- 4Intermediate 13 minAmazon Connect + AVD/Windows 365: Audio Optimization in VDIAWS announced Amazon Connect audio optimization support for Azure Virtual Desktop (AVD) and Windows 365 Cloud PC via Microsoft Multimedia Redirection (MMR), extending a capability already present for WorkSpaces, Citrix, and Omnissa. The mechanism redirects media processing from the session host to the agent's local device, reducing latency and improving voice quality in heterogeneous VDI environments. In this article, I assess what this feature actually delivers, where it falls short, and how to integrate it into financial-grade contact center architectures.
- 5Advanced 11 minTPU Developer Hub: A Technical Review of a High-Performance AI PlatformThe TPU Developer Hub consolidates tooling, documentation, and high-performance ML stacks around Google Cloud TPUs. For architects operating in financial-grade environments with latency, cost, and governance demands, understanding where this platform delivers real value — and where it imposes operational friction — is essential before any migration commitment.
- 6Advanced 8 minAgent Evaluation as an Engineering DisciplineAI agent evaluation has moved beyond ad hoc prompt engineering into a full engineering discipline with versioned datasets, automated quality gates, and regression traceability. Bedrock AgentCore materializes that shift by bringing managed infrastructure to the agent testing lifecycle. For financial-grade systems architects, this changes the contract between ML teams and platform engineering.
- 7Advanced 12 minDocument Automation with Bedrock: A Modernization JourneyLegacy document extraction pipelines in financial environments accumulate silent technical debt: brittle OCR, manual rules, and absent traceability. In this article, I narrate the modernization journey to Bedrock Data Automation, covering architecture decisions, managed risks, and what genuinely changes in operations. The analysis is grounded in real patterns from critical financial systems, not lab demos.
- 8Advanced 10 minWeb Search on Bedrock AgentCore: An In-Depth Technical ReviewWeb Search on Amazon Bedrock AgentCore delivers managed web search for AI agents, with zero data egress outside the AWS environment and MCP-based grounding. I review the capability with a senior architect's critical eye: real trade-offs, operational limits, and when adoption actually makes sense.
- 9Advanced 8 minInvokeGuardrailChecks vs Classic Guardrails: Which to Use in AI Agents?AWS released the InvokeGuardrailChecks API in Amazon Bedrock Guardrails — a resourceless API that lets you apply individual safeguards at any point in an agentic loop without creating or versioning guardrail resources. In this article, I run a direct head-to-head between this approach and classic resource-based Guardrails, evaluating latency, governance, cost, and fitness for financial-grade mission-critical systems.
- 10Advanced 11 minAmazon Bedrock AgentCore: Continuous Agent Optimization in ProductionAmazon Bedrock AgentCore introduces a continuous improvement loop that turns production traces into actionable diagnostics, data-grounded recommendations, and statistical validation via A/B testing. For architects of financial systems and high-stakes platforms, this represents AWS's first serious attempt to close the gap between agent observability and reliable production operation.
- 11Advanced 9 minManaged Syslog Ingestion in CloudWatch: Anatomy of a PatternCloudWatch Logs now accepts syslog directly via VPC endpoint — no agents, with automatic parsing of RFC 5424, RFC 3164, and Cisco FTD/ASA. This shifts the log collection pattern for network devices and Linux servers in regulated environments. In this article, I dissect the pattern anatomy, its real limits, and the anti-patterns I've seen burn teams in production.
- 12Advanced 9 minAmazon Bedrock AgentCore Harness: From Idea to Production-Grade AgentAgentCore Harness reached GA in June 2026 as a managed abstraction that collapses the LLM agent control plane into two API calls. In this article, I analyze how the harness works internally, where it fails, and what architects of financial-grade systems need to understand before putting it into production.
- 13Advanced 10 minAMI Watermarks: Image Governance at Financial-Grade ScaleAMI Watermarks arrive in EC2 as a provenance primitive that persists across cross-region copies, cross-account sharing, and new AMI creation from running instances. For financial environments with hundreds of accounts and dozens of regions, this solves a problem that tag scripts and SCPs partially addressed — but never reliably. In this article, I walk through the migration journey from an ad hoc model to an auditable chain of custody.
- 14Advanced 10 minC7a in Singapore: A Migration Incident Retro for Financial-Grade SystemsThe EC2 C7a landing in Asia Pacific (Singapore) on June 25, 2026 is not just a hardware announcement — it is a migration trigger with real traps for teams running low-latency financial workloads in the region. In this retro, I walk through what happens when teams migrate from C6a to C7a without proper preparation: from EBS volume limit surprises to performance regressions caused by NUMA misconfiguration. I close with a concrete set of resilience changes I would apply immediately.
- 15Advanced 8 minGraviton4 R8g: Global Expansion and What Changes for Memory-Intensive ArchitecturesAWS has expanded EC2 R8g Graviton4 instances to five new regions — Thailand, New Zealand, South Africa, Italy, and Canada West — completing a global rollout that reshapes the cost-performance equation for memory-intensive workloads outside major hubs. With up to 1.5 TB RAM, 48xlarge sizing, and 40% database gains over Graviton3, this is not an incremental upgrade. It is a platform maturity signal that changes architecture decisions in regions where instance choice was previously constrained.
- 16Advanced 9 minEC2 R8g in New Regions: Migration Field Guide for Financial WorkloadsThe expansion of EC2 R8g instances to Thailand, New Zealand, Cape Town, Milan, and Calgary is far more than a regional availability note — it is an architecture decision with direct implications for latency, data compliance, and operational cost. In this article, I document what I learned migrating memory-intensive financial workloads from R7g to R8g, including the gotchas that never appear in the official docs.
- 17Advanced 8 minEC2 R8g and Graviton4: A Technical Deep Dive for Memory-Intensive WorkloadsEC2 R8g instances powered by Graviton4 are now available in regions including Africa (Cape Town), Europe (Milan), and Asia Pacific (Thailand, New Zealand), delivering up to 1.5 TB of memory and 3x more vCPUs than the previous generation. In this article, I analyze the real mechanisms behind this performance leap, the migration trade-offs, and the design patterns that make these instances relevant for critical financial-grade systems.
- 18Advanced 12 minAWS WAF on AgentCore Gateway: Production Security for Agentic AIThe general availability of AWS WAF for Amazon Bedrock AgentCore Gateway marks an important inflection point: agentic AI workloads can now receive consistent edge protections without per-agent instrumentation. I analyze what this integration actually delivers, where it still leaves gaps, and how to build a mature security posture for agentic systems in production.
- 19Advanced 9 minCloudWatch Logs Tag Enrichment vs. Alternative ApproachesCloudWatch Logs now enriches log events with resource tags at ingestion time, at no extra cost and without instrumentation changes. But does this replace custom enrichment pipelines, OpenTelemetry-based approaches, or third-party solutions like Datadog? I do an honest trade-off analysis for teams running financial-grade systems on AWS.
- 20Advanced 7 minIaC for AI Platforms: Terraform and SageMaker Unified StudioOfficial Terraform support for SageMaker Unified Studio closes a critical gap: AI platforms can now be provisioned with the same IaC rigor applied to networks and databases. In this article I dissect the pattern, its modular anatomy, when it solves the right problem, and when it conceals dangerous technical debt.
- 21Advanced 12 minSageMaker Unified Studio via Terraform: Migrating to IaC in Financial-Grade EnvironmentsTerraform support for Amazon SageMaker Unified Studio, announced in July 2026, closes a critical gap for data platforms in regulated environments: ML domains that previously required ClickOps or brittle SDK automation can now be versioned, reviewed, and promoted like any other infrastructure resource. In this article, I analyze the migration journey from a console-driven initial state to a full IaC pipeline, with particular attention to the IAM pitfalls, blueprint governance, and operational observability that make the difference in financial-grade environments.
- 22Advanced 10 minSageMaker Unified Studio + Terraform: IaC for AI Platforms Incident RetroThe absence of reproducible infrastructure-as-code for unified AI platforms is not a convenience problem — it is a vector for governance incidents, configuration drift, and audit failures in financial-grade environments. Terraform support for Amazon SageMaker Unified Studio, launched in July 2026, closes a critical gap I have seen cause real incidents at multiple enterprise customers. This retro analyzes the failure pattern, the typical timeline, and the resilience changes that must follow.
- 23Advanced 8 minSageMaker Unified Studio + Terraform: IaC for Financial-Grade AI PlatformsThe official Terraform support for SageMaker Unified Studio, launched in July 2026, closes a critical gap for platform teams operating in regulated financial environments: the ability to version, audit, and promote AI/data domains with the same rigor applied to any other infrastructure resource. This briefing analyzes what changes in practice, where the real risks lie, and how to position this capability within an Internal Developer Platform strategy.
- 24Advanced 9 minGameLift Streams Admin Shell: Secure Live-Session Access Without SSHAmazon GameLift Streams now provides secure terminal access to live sessions via SSM Session Manager — no SSH, no open ports, no infrastructure credentials. This mechanism has serious architectural implications for teams operating streaming platforms at scale, particularly around audit trails, blast radius, and ephemeral access control. I analyze how the feature works internally, where it can fail, and how to integrate it safely in financially critical environments.
- 25Advanced 10 minR8i: Anatomy of an Instance Family for I/O-Intensive WorkloadsThe R8i family lands in Tokyo, Frankfurt, and Ireland with 600 Gbps network bandwidth and 300 Gbps EBS bandwidth — the highest figures among non-accelerated EC2 instances. Before migrating critical workloads, it is worth dissecting the anatomy of these four variants, understanding the real trade-offs, and knowing precisely when this family solves the problem and when it is the wrong choice.
- 26Advanced 10 minDRS + EBS Initialization Rate: Predictable RTO in Financial-Grade EnvironmentsAWS Elastic Disaster Recovery now supports EBS Provisioned Rate for Volume Initialization, eliminating storage performance variability from the critical RTO path. For financial systems architects, this shifts the conversation from 'we hope the volume initializes in time' to 'we know exactly when storage will reach full performance'. The signal is small on the surface, but the impact on DR design is substantial.
- 27Advanced 9 minCloudWatch Logs Intelligent Tiering: Field Guide for Financial-Grade EnvironmentsCloudWatch Logs Intelligent Tiering arrived in July 2026 promising lower log retention costs without operational overhead — but for financial-grade environments with audit requirements, the story is more nuanced. In this field note, I analyze the three tiers, the automatic transition thresholds, and where this feature genuinely delivers value versus where it can create unpleasant surprises.
- 28Advanced 9 minAmazon Managed Grafana FedRAMP High: Observability in Regulated EnvironmentsAmazon Managed Grafana has achieved FedRAMP High authorization in AWS GovCloud (US-East) and (US-West) regions, unlocking managed observability for federal agencies and sectors with strict compliance requirements. In this article, I analyze what that authorization actually means architecturally, the design patterns it enables, and the anti-patterns that persist even with an authorized service.
- 29Advanced 10 minIAM Roles for GameLift Streams: The End of Embedded CredentialsAmazon GameLift Streams now supports IAM roles for stream sessions, eliminating the need for long-lived credentials embedded in application bundles or passed as environment variables. The change aligns the service with the same container credential provider mechanism already trusted by ECS and EKS — with no application code changes required. In this article, I analyze what this feature actually delivers, where meaningful limits remain, and how to adopt it rigorously in production environments.
- 30Advanced 9 minADR: IAM Role Sessions in GameLift Streams — Eliminating Static CredentialsAmazon GameLift Streams added per-session IAM role support in July 2026, eliminating the need for static credentials embedded in application bundles. This article analyzes the architectural decision behind this change, the security patterns it embodies, and the operational consequences for teams building streaming platforms with AWS resource access.
- 31Advanced 9 minFinOps for Generative AI: Dissecting the Bedrock Cost Pattern in CUR 2.0With standardized Bedrock metadata now available in AWS Data Exports, generative AI cost attribution no longer depends on brittle free-text field parsing — it gains native structure in CUR 2.0. In this article, I dissect the anatomy of this pattern, the scenarios where it genuinely solves the problem, and the failure modes that persist when AI governance is not aligned with the FinOps pipeline.
- 32Advanced 10 minMigrating High-Network Workloads to EC2 R6in/R6idn in Paris and CanadaThe availability of R6in and R6idn instances in Europe (Paris) and Canada (Central) in July 2026 closes a critical data-residency gap for financial-grade and real-time analytics workloads. This article narrates the migration journey from R5n to R6in/R6idn instances, detailing architecture decisions, operational risks, and the measurable network and IOPS gains that justify the move.
- 33Advanced 10 minC7a in us-west-1: Migration Retro and Production ResilienceThe EC2 C7a landing in us-west-1 in July 2026 looks trivial — one more region, one more instance type. But for teams running compute-intensive workloads under tight SLOs, every regional expansion carries real migration risks that rarely surface in announcements. In this retro, I analyze what can (and usually does) go wrong, the systemic root cause, and how to build the right remediation.
- 34Advanced 10 minZone-Aware Routing in ECS Service Connect: The End of the Cost vs. Resilience Trade-offECS Service Connect gained zone-aware routing in July 2026, automatically preferring same-AZ endpoints without additional code. For financial architectures with high-frequency service-to-service calls, this materially changes the economics of multi-AZ design. In this article, I analyze the mechanism, real trade-offs, and how to position this feature in payment platforms and real-time data systems.
- 35Advanced 11 minAmazon Connect + AVD: VDI Audio Optimization in Financial-Grade EnvironmentsAmazon Connect's native media redirection support for Azure Virtual Desktop and Windows 365 Cloud PC closes a critical operational gap in financial contact centers that have already migrated agents to hybrid VDI. The mechanism uses Microsoft Multimedia Redirection (MMR) to offload WebRTC audio processing from the session host to the agent's local device — reducing perceived latency and eliminating the double-encoding that degrades voice quality. This article details what changes architecturally, the deployment gotchas, and an actionable checklist for platform teams.
- 36Advanced 10 minVDI Media Redirection in Amazon Connect: How It Really WorksAmazon Connect's support for Azure Virtual Desktop and Windows 365 via Microsoft Multimedia Redirection looks simple on the surface, but it hides a media routing decision chain with serious implications for latency, security, and compliance. In this article I dissect the mechanism layer by layer, expose the failure modes the documentation doesn't mention, and offer a design model for high-demand financial environments.
- 37Advanced 9 minTBAC vs Explicit ARN vs SCP vs VPC Isolation in NeptuneNeptune now supports Tag-Based Access Control (TBAC) for IAM, adding a fourth access control model to a service that already offered VPC isolation, IAM authentication with explicit ARNs, and Service Control Policies. Choosing the right model — or the right combination — has direct implications for security posture, team onboarding velocity, and operational cost in financial data platforms.
- 38Advanced 9 minADR: EKS Provisioned Control Plane and 40x HPA ConcurrencyEKS Provisioned Control Plane now processes HPA objects with up to 40x more concurrency than the Kubernetes default, eliminating a silent bottleneck in clusters running hundreds of workloads. In this architecture decision record, I analyze the context that makes this change meaningful, the options that existed before it, and the operational consequences architects need to address now.
- 39Advanced 9 minAutoScalingInstanceRefresh in CloudFormation: Pattern TeardownThe integration of Instance Refresh as a native CloudFormation update policy closes an operational gap that forced teams to orchestrate AMI deployments outside the IaC lifecycle. In this article, I dissect the pattern's anatomy, its real failure modes, and when it is — and is not — the right choice for high-criticality environments.
- 40Advanced 9 minMigrating to Native Git in SageMaker Unified StudioSageMaker Unified Studio replaced the automatic sync model with flexible, file-level Git version control spanning Query Editor, Visual ETL, Workflows, and Notebooks in a unified experience. For teams in regulated environments, this change is not cosmetic — it redefines auditability, artifact traceability, and the governance model for analytical code. In this article, I walk through the migration journey, the real risks, and the architecture decisions that matter in production.
- 41Advanced 10 minAurora DSQL Multi-Region: What Changes for Financial-Grade ArchitecturesAmazon expanded Aurora DSQL multi-Region clusters to four additional Regions in July 2026, bringing the total to 16 Regions with active-active write support across both sides of a peered pair. For financial systems architects, this is not merely a geographic expansion — it is a fundamental shift in the resiliency model available without managing manual replication or accepting eventual consistency. In this briefing, I analyze what this signal means for high-availability platform design, where the trade-offs actually live, and how to position this technology within a data portfolio.
- 42Advanced 11 minAWS Network Firewall as Forward Proxy: Technical Review of the PreviewAWS has reintroduced forward proxy as a native functionality of Network Firewall, unifying security policies between transparent and explicit proxy modes under a single resource. This review examines what changed from the November 2025 preview, where the functionality genuinely adds value in financial-grade environments, and where operational risks still warrant caution.
- 43Advanced 10 minFractional GPU on ECS: Architecture Decision Record for AI InferenceAmazon ECS now supports fractional GPU scheduling on EC2 G6f instances, enabling partitions as small as 1/8 of an NVIDIA L4 GPU with 3 GB of memory. For financial-grade AI inference platforms, this fundamentally changes the cost and workload density calculus. This ADR documents the context, options considered, the decision, and real operational consequences.
- 44Advanced 8 minR8i vs R8i-flex: Anatomy of a Memory-Optimized Instance DecisionThe arrival of R8i and R8i-flex instances in the Europe (Milan) region in August 2026 completes a European expansion that started in Paris and continued through Stockholm and Zurich. More than a regional availability announcement, this move exposes a relevant architectural pattern: the bifurcation between continuous high-performance instances (R8i) and instances optimized for variable-utilization workloads (R8i-flex). Understanding when and why to choose each path is what separates a mature infrastructure decision from expensive over-provisioning.
- 45Advanced 10 minCloudWatch Alarm Warm-Up: Ending Startup Noise in CI/CD PipelinesCloudWatch now supports warm-up periods for alarms, solving a classic operational noise problem in automated deployments. The feature looks simple, but it carries serious implications for SLOs, on-call fatigue, and pipeline design in financial-grade environments. In this article, I analyze the mechanism, the real trade-offs, and how to integrate this responsibly into production stacks.
- 46Advanced 7 minAmazon Connect compact mode: operational density with cautionCompact mode in Amazon Connect Customer dashboards looks small, but it touches a central point in critical operations: reducing the time between anomaly, perception, and action. I see it as a useful operational cockpit improvement, as long as it does not become a substitute for alerts, SLOs, automation, and careful metric design.
- 47Advanced 9 minMWAA with Airflow 3.3.1: state, language, and operational disciplineI see Amazon MWAA support for Apache Airflow 3.3.1 as an important evolution for pipelines that no longer fit a purely stateless model. The real gain is durable state, asset partitioning, and better operational ergonomics; the risk is treating experimental capabilities as a mature enterprise platform too early.
- 48Advanced 8 minDocumentDB 8.0: direct MVU reduces risk, not migration workDirect major version upgrade support to Amazon DocumentDB 8.0 is an important improvement for teams still carrying 3.6 or 4.0 clusters. I would treat it as fewer steps and less exposure, not as permission to skip rehearsal, compatibility testing, and rollback planning.
- 49Advanced 7 minPRM by User Agent: better attribution, governance still requiredThe Partner Revenue Measurement User Agent expansion is small to implement and meaningful for the economic visibility of SaaS and ISV solutions on AWS. I like the direction, but I would treat it as attribution telemetry, not as a primary financial system.
- 50Advanced 7 minMediaTailor Analytics: console, BI, or lakehouse?The AWS Elemental MediaTailor analytics dashboard changes the first line of investigation for publishers running SSAI across multiple regions. I see it as an excellent operational layer, but not an automatic replacement for BI, financial reconciliation, or engineering observability.
- 51Advanced 7 minADR: bringing governed agents into Amazon QuickThe Amazon Quick and AWS Agent Registry integration changes the control point: the problem stops being manual MCP setup and becomes governance of a catalog consumable by business users. I would treat this as a platform decision, not a console convenience.
- 52Advanced 6 minPrivate Redshift SSO with EVR: a pattern teardownI see this launch as an important architectural correction: authentication now follows the same private path as analytical data. For regulated environments, the gain is not only SSO; it is removing a network exception that is hard to defend in audit.
- 53Advanced 9 minMigrating Time Series to Timestream for InfluxDBThe August 31, 2026 regional expansion of Amazon Timestream for InfluxDB changes the adoption conversation for teams that need operational data closer to users and local rules. I would treat it as a controlled modernization opportunity, not as a simple endpoint swap.
- 54Advanced 7 minActive-active Amazon Connect: the resilience lessonThe August 31, 2026 launch changes the operating model: two Amazon Connect regions can actively serve contacts and agents with unified operational visibility. I read it less as a failover feature and more as a correction to a classic weakness: the standby environment nobody exercises until the day it is needed.
- 55Advanced 10 minClaude Fable 5.1 on AWS: the model that demands an immutable historyFable 5.1 landed on Bedrock on September 1, 2026 with the same input and output price as Fable 5, but cache reads at a quarter of the cost. What the announcement doesn't say is that it trades orchestration flexibility for reasoning quality: forced tool_choice is gone, and editing history is now an error. I reviewed what that means for anyone running long-horizon agents inside the AWS perimeter.
- 56Advanced 7 minApps in Amazon Quick vs. App Studio vs. a custom buildOn September 1, 2026 AWS made natural-language app building generally available inside Amazon Quick. The architecture question is not whether it works — it is which of four routes still holds up once the app becomes part of the monthly close. I compare seat vs. user-hour pricing, identity propagation and exit cost.
- 57Advanced 8 minSnapStart on containers: the bake-off against provisioned concurrencyAWS enabled SnapStart for functions packaged as container images, promising sub-second startup on artifacts of up to 10 GB. I put it head-to-head with provisioned concurrency, with .zip packaging and with an always-on Fargate service, using published prices and documented limits. The conclusion is not about latency: it is about where your pipeline starts paying rent.
- 58Advanced 8 minBedrock Web Search in GovCloud: an ADR on grounding under complianceOn September 2, 2026 AWS brought the server-side Web Search tool on Amazon Bedrock to GovCloud (US-West). I wrote this ADR because the real decision is not "web search or no web search" — it is which retrieval mode you operate in, and the default of the `external_web_access` parameter pushes regulated teams to exactly the wrong side, with an HTTP 200 and no visible error.
- 59Advanced 7 minCritical or non-critical: the failure contract of ECS daemonsOn September 3, 2026 AWS started letting you declare an ECS Managed Daemon as non-critical, turning a decision that used to be implicit into a versioned parameter. What is at stake is not the daemon: it is the failure contract between a cross-cutting agent and the instance hosting it. This teardown dissects the anatomy of the pattern, the decision rule I use to classify each agent, and what you pay — in churn, in blind spots and in dollars — for classifying it wrong.
- 60Advanced 8 minAMIs with a contract: anatomy of EC2's new instance-type blockOn September 4, 2026 EC2 started accepting an `InstanceTypeSpecification` on an AMI: two lists, evaluated at `RunInstances`, that block launches on incompatible instance types. The pattern moves compatibility from the caller to the artifact — and it ships with a trap most teams will only find the hard way: the specification matches strings, not hardware capabilities.
- 61Advanced 9 min3LO in Bedrock Managed KB: 5-minute setup, 1 irreversible decisionOn September 4, 2026 AWS shipped user-managed setup (3LO) for SharePoint, OneDrive and Confluence in Amazon Bedrock Managed Knowledge Base: you sign in with your own account and the data source is live in minutes. What the docs say in fine print is that this path does not support document-level access control, and that the ACL flag cannot be changed after CreateDataSource. This is the story of the migration that forces — from a 3LO prototype to a production knowledge base on ENTRA_ID_APP_ONLY, certificate and userContext.
- 62Advanced 8 minRAG on ServiceNow: the connector that erases user criteriaAmazon Bedrock Managed Knowledge Base got a native ServiceNow connector on September 4, 2026, and it removes weeks of hand-rolled pipeline. It also tells you to use a service account with knowledge_admin, which bypasses per-knowledge-base user criteria — and the connector ingests no document-level ACL. This is the retro of the pilot where those two lines of documentation met.
- 63Advanced 8 minECS Early Success Criteria: where your deployment rollback endsOn September 4, 2026, Amazon ECS started letting you declare when a rolling deployment is successful, using a healthyPercent over the desired count. This is not a faster-deploy button — it is the definition of where the circuit breaker and alarm-based rollback stop protecting you. This briefing covers the arithmetic of the parameter, the two source-revision cleanup modes, and what your dashboard starts hiding.
- 64Advanced 8 minFable 5.1 on Bedrock: data retention is now an architecture decisionClaude Fable 5.1 landed on Bedrock on September 1, 2026 with a 1M-token context window and a condition no prior Anthropic model carried: you must explicitly authorize retention of prompts and outputs for up to 30 days inside the AWS boundary. This is not a consent checkbox — it is an account-scoped setting with organizational blast radius, and it collides head-on with the zero-data-retention SCP most regulated environments already have written.
- 65Advanced 7 minGPT-6 Astra on Bedrock: the endpoint decides what you auditGPT-6 Astra reached GA on Amazon Bedrock on September 8, 2026 with a 1,050,000-token context window and an architectural fork: the model is served by `bedrock-runtime` and by `bedrock-mantle`, and each endpoint withholds something the other gives. I break down what each path costs in money, in quota and in auditable trail — and why, for regulated workloads in Brazil, the conversation starts and ends at data residency.
- 66Advanced 8 minWorkload-type capacity in Amazon Connect: what actually changesAmazon Connect now lets you set concurrency per workload type inside the Task and Email channels instead of per channel. The operational gain is real on high-variance queues — disputes, KYC, regulated back office. The price is a new taxonomy to govern and a failure mode that does not shout: a contact whose workload type has no matching row in the routing profile stays queued forever.
- 67Advanced 7 minLambda recursive loops: four guardrails compared in the Sovereign CloudLambda recursive loop detection reached the European Sovereign Cloud on September 10, 2026. It cuts the chain at ~16 invocations, but only across Lambda, SQS, SNS and S3, and the alert can take 3.5 hours. I compare four guardrails — native detection, structural separation, a concurrency ceiling and an application-level hop counter — and say when each one is enough.
- 68Expert 7 minGPT-5 vs Claude vs Nova on Bedrock: A Production Governance Bake-offWith GPT-5.5 and Codex landing on Amazon Bedrock, platform teams now face a genuine choice between three frontier model families within the same control plane. This analysis compares GPT-5.5, Claude 3.7 Sonnet, and Amazon Nova Pro through the lens of teams shipping AI into regulated production environments.
- 69Expert 9 minADR: Adopting Amazon Bedrock AgentCore in ProductionBedrock AgentCore promises to reduce the operational friction of running AI agents in production, but adopting any managed agent orchestration platform demands an explicit architectural decision. In this ADR, I document the forces that drove me to evaluate AgentCore, the alternatives considered, and the real consequences of each path.
- 70Expert 9 minEC2 G7e: Architecture Decision for Generative Video InferenceEC2 G7e instances arrive with NVIDIA L40S GPUs and promise to redefine cost-per-frame for generative video inference workloads. In this architecture decision record, I evaluate the forces that make this choice non-trivial, the failure patterns I have seen in production, and the configuration I would adopt in a financial-grade environment.
- 71Expert 8 minContract Intelligence on AWS: Field-Notes ArchitectureBuilding contract intelligence with generative AI goes far beyond wiring an LLM to PDFs. This article documents the architectural patterns, operational gotchas, and design decisions that separate an impressive PoC from a reliable system in financial-grade production.
- 72Expert 8 minAgentic RAG on AWS: Architecture Bake-Off for Financial-Grade PlatformsAgentic RAG has moved from lab experiment to platform requirement in financial environments that demand auditability, cost control, and predictable latency. In this article I compare four concrete architectural approaches on AWS, with real trade-offs, plausible numbers, and an unambiguous recommendation.
- 73Expert 9 minBedrock Managed Knowledge Base: Anatomy of a Managed RAG PipelineAmazon Bedrock Managed Knowledge Base abstracts the entire RAG stack — connectors, parsing, embeddings, re-ranking, and agentic retrieval — into a single managed primitive. In this article, I disassemble each layer, expose the failure modes the documentation doesn't mention, and analyze the real trade-offs for engineers designing financial-grade AI systems on AWS.
- 74Expert 9 minSecure Multi-Tenant RAG: ADR for Two-Layer AuthorizationAuthorization in multi-tenant RAG is not an implementation detail — it is an architectural decision with direct consequences for compliance, cross-tenant data leakage, and LLM attack surface. In this ADR, I document the forces that led me to adopt a defense-in-depth pattern with Amazon Verified Permissions and Bedrock Knowledge Bases, the alternatives I discarded, and the operational consequences that must be managed.
- 75Expert 9 minADR: Scaling Agents to Production with AgentCore Runtime QuotasIn July 2026, AWS raised AgentCore Runtime default limits to 5,000 active concurrent sessions in us-east-1/us-west-2 and 200 interactions per second across all regions. This ADR documents the context that forced this design decision, the architectural options I evaluated for financial-grade agentic systems at scale, and the operational consequences you must plan for before putting agents into production.
- 76Expert 10 minDPD on HyperPod: Disaggregated Prefill and Decode in ProductionSageMaker HyperPod now supports Disaggregated Prefill and Decode (DPD), separating the two LLM inference phases onto dedicated GPU pools connected via EFA and GPU-Direct RDMA. This change resolves one of the most persistent production problems: a single long-context request degrading per-token latency for every concurrent request. In this article, I analyze the real trade-offs, the failure modes you will encounter, and a playbook for enabling DPD on demanding financial-grade workloads.
- 77Expert 10 minOAuth on AWS MCP Server: Auth Strategy Bake-Off for AI AgentsNative OAuth support on the AWS MCP Server changes the game for teams that were improvising agent authentication with static credentials or custom Cognito flows. But 'OAuth support' is not an architecture decision — it is a starting point. In this article, I run an honest bake-off across four authentication strategies for AI agents in financial-grade environments, with real trade-offs, plausible numbers, and a direct recommendation.
- 78Expert 10 minADR: Migrating Financial Workloads to EC2 R8i in Tokyo and FrankfurtThe availability of EC2 R8in, R8ib, R8idn, and R8idb instances in Tokyo, Frankfurt, and Ireland opens a real decision window for financial architectures that depend on sub-millisecond network latency, extreme EBS throughput, and data residency compliance. This ADR documents the reasoning behind adopting — or not — these instances for financial-grade workloads.
- 79Expert 12 minMigrating Financial Workloads to EC2 R8i: Decisions and Trade-offsThe July 2026 availability of EC2 R8i instances (R8in, R8ib, R8idn, R8idb) in Tokyo, Frankfurt and Ireland opens a concrete modernization window for financial platforms still running on R6i/R6in — generations with real network bandwidth and EBS throughput ceilings. This article narrates the migration journey as a sequence of architecture decisions, with risks managed at each step and the numbers that justify the move.
- 80Expert 9 minGPT-5.6 on Bedrock: Adoption Retro for Financial-Grade EnvironmentsThe July 13, 2026 launch of GPT-5.6 Sol, Terra, and Luna on Amazon Bedrock exposed rushed adoption patterns I have seen repeatedly in regulated financial environments. This retro examines what happens when engineering teams integrate third-party models via Bedrock without adequate governance controls — and how to correct course before the next incident occurs.
- 81Expert 11 minAurora DSQL Multi-Region: A Resilience Retro for Financial-Grade SystemsAurora DSQL's expansion to Stockholm, Spain, Mumbai, and Singapore in July 2026 is not merely a regional availability announcement — it signals the maturity of a distributed database primitive that fundamentally changes the resilience calculus for financial-grade systems. In this retro, I analyze what this active-active topology with strong consistency actually means in practice, where teams typically go wrong during adoption, and which design changes must follow.
- 82Expert 11 minAurora DSQL Multi-Region: Field Notes for Financial-Grade SystemsAurora DSQL's expansion to Stockholm, Spain, Mumbai, and Singapore in July 2026 brings multi-region strong consistency within reach of financial architectures across Europe and Asia-Pacific. In this article, I analyze the real trade-offs of adopting distributed active-active SQL, the patterns that work, and the anti-patterns that will cost you dearly in production.
- 83Expert 10 minAWS Transform Continuous Modernization: A Deep Technical AnalysisAWS Transform Continuous Modernization reached general availability in August 2026, bringing autonomous technical debt analysis and remediation across code repositories at enterprise scale. In this article I go beyond the announcement and examine the execution mechanism, real failure modes, and the trade-offs every platform team needs to understand before connecting their production repositories.
Deep-dive studies
tutorialSAP LeanIX in Practice: The Architect's Guide — Inventory, Diagrams, and ReportsA practical, opinionated tutorial on using SAP LeanIX as a transformation accelerator in the architect's daily work — covering inventory (Fact Sheets, meta model, quality), diagrams (types, when to use, live vs static), and reports (question → data → decision). Uses Hohpe's Architecture Elevator as the connecting thread and a fictional insurer/bank scenario to make every concept concrete.guideLoop Engineering: designing the loops that guide AI agentsThe bottleneck in AI agents has shifted from the prompt sentence to the loop design: trigger, topology, verifier, and stop rules. This guide teaches loop engineering fundamentals — from the base ReAct loop to a pattern catalogue — with real examples from my own system and a step-by-step guide for engineering any loop safely.guideLambda vs ECS: the architect's compute decision guide on AWSChoosing between Lambda and ECS is not about preference — it is about matching the unit of scale to the load pattern. This guide covers every Lambda type (including MicroVMs and Managed Instances) and ECS type (Fargate, EC2, Managed Instances), the decision framework I use in practice, and the real impact on engineering, business, and customer experience.playbookPlaybook: 5 AI Architecture Shifts — and what to do about each oneWhat was advanced in 2025 became default in 2026: the bottleneck moved past the prompt, agents went to managed production, MCP standardized tooling, security became layered, and token FinOps entered the roadmap. This playbook maps each shift to concrete actions — for people building systems, not demos.guideInside AI Agents (1/3): Anatomy and the Reasoning LoopA technical lesson for developers and architects who hear 'AI agent' every day but want to truly understand what differentiates an agent from a plain LLM, a fixed pipeline, or simple RAG. We cover the full anatomy — model, tools, memory, planner — and the ReAct loop step by step with a concrete example. No hype; real trade-offs.guideInside AI Agents (2/3): Architecture Pattern Catalog — from ReAct to Multi-AgentThe second lesson in the series maps the full catalog of AI agent architecture patterns: from single-agent loops (ReAct, Reflexion, Plan-and-Execute) to multi-agent orchestration, covering memory as an architecture decision, guardrails, and human-in-the-loop. The goal is to give the architect a precise vocabulary to choose — and justify — the right pattern for each problem, without falling into classic anti-patterns.