The path· 13
- 1Intermediate 7 minNew York suspends new data centers above 50 MWGovernor Kathy Hochul signed an order pausing new 50 MW+ data centers for up to a year while the state runs an environmental study. It targets AI's pressure on the grid, water use and cost-shifting to the public — and signals a new regulatory risk for anyone designing cloud and AI workloads.
- 2Advanced 11 minPixels to Planning: Geospatial Data Platforms on AWSEarth AI platforms are leaving research labs and entering real operational decisions — from climate credit to infrastructure asset management. Architecting this pipeline on AWS requires precise choices about raster/vector ingestion, geospatial partitioning, inference latency, and data lineage. This article documents the decisions I would make today, the anti-patterns I have seen in the field, and the checklist you can act on tomorrow.
- 3Advanced 8 minCustom Lens for Data Platforms: Anatomy of a PatternThe AWS Well-Architected Custom Lens is often treated as a documentation artifact — but when applied to enterprise data platforms, it becomes an operational governance mechanism with real teeth. In this article, I dissect the pattern's anatomy, expose its most common adoption failures, and propose a reference design that connects lens reviews to automated remediation pipelines.
- 4Advanced 9 minCloudWatch Logs Tag Enrichment vs. Alternative ApproachesCloudWatch Logs now enriches log events with resource tags at ingestion time, at no extra cost and without instrumentation changes. But does this replace custom enrichment pipelines, OpenTelemetry-based approaches, or third-party solutions like Datadog? I do an honest trade-off analysis for teams running financial-grade systems on AWS.
- 5Advanced 9 minGameLift Streams Admin Shell: Secure Live-Session Access Without SSHAmazon GameLift Streams now provides secure terminal access to live sessions via SSM Session Manager — no SSH, no open ports, no infrastructure credentials. This mechanism has serious architectural implications for teams operating streaming platforms at scale, particularly around audit trails, blast radius, and ephemeral access control. I analyze how the feature works internally, where it can fail, and how to integrate it safely in financially critical environments.
- 6Advanced 9 minCloudWatch Logs Intelligent Tiering: Field Guide for Financial-Grade EnvironmentsCloudWatch Logs Intelligent Tiering arrived in July 2026 promising lower log retention costs without operational overhead — but for financial-grade environments with audit requirements, the story is more nuanced. In this field note, I analyze the three tiers, the automatic transition thresholds, and where this feature genuinely delivers value versus where it can create unpleasant surprises.
- 7Advanced 7 minAmazon Connect compact mode: operational density with cautionCompact mode in Amazon Connect Customer dashboards looks small, but it touches a central point in critical operations: reducing the time between anomaly, perception, and action. I see it as a useful operational cockpit improvement, as long as it does not become a substitute for alerts, SLOs, automation, and careful metric design.
- 8Advanced 7 minMediaTailor Analytics: console, BI, or lakehouse?The AWS Elemental MediaTailor analytics dashboard changes the first line of investigation for publishers running SSAI across multiple regions. I see it as an excellent operational layer, but not an automatic replacement for BI, financial reconciliation, or engineering observability.
- 9Advanced 6 minPrivate Redshift SSO with EVR: a pattern teardownI see this launch as an important architectural correction: authentication now follows the same private path as analytical data. For regulated environments, the gain is not only SSO; it is removing a network exception that is hard to defend in audit.
- 10Advanced 8 minRedshift and Iceberg v3: field notes for mutable lakesAmazon Redshift support for Apache Iceberg v3, announced on August 31, 2026, changes the conversation about mutable data lakes. I would treat default values, row lineage, and deletion vectors as operational primitives, not just table-format features.
- 11Advanced 8 minWorkload-type capacity in Amazon Connect: what actually changesAmazon Connect now lets you set concurrency per workload type inside the Task and Email channels instead of per channel. The operational gain is real on high-variance queues — disputes, KYC, regulated back office. The price is a new taxonomy to govern and a failure mode that does not shout: a contact whose workload type has no matching row in the routing profile stays queued forever.
- 12Advanced 7 minMediaLive without timecode: what Video Aligned Locking changes in redundancyMediaLive can now synchronize pipelines by visual frame signature, with no dependency on embedded timecode — precisely the missing piece for field SRT/RTMP sources and for single-pipeline channels linked across regions. I dissect the pattern: the problem it solves, the anatomy of locking modes and methods, the frame-rate and input rules that silently break sync, and the three metrics that need alarms before this goes to production.
- 13Expert 9 minML Observability on EKS: Logs, Metrics and Tracing Head-to-HeadML workloads on EKS generate telemetry volumes that expose the limits of any observability pipeline not designed for that profile. In this article I compare four collection and routing approaches for logs and metrics, focusing on real cost, diagnostic latency and fitness for regulated financial environments.
Deep-dive studies
teardownTeardown: Resilient Network Graphs and the Next-Generation AI NetworkAn in-depth architectural analysis of the resilient graph-based data center networks AWS is building to support AI workloads at scale — covering topology, congestion control, energy efficiency, and the trade-offs that define the next generation of cloud infrastructure.adrADR: OpenSearch Serverless vs Dedicated Vector Database for Agentic RAGThis ADR evaluates vector search infrastructure options for a multi-tenant agentic RAG platform on AWS, comparing OpenSearch Serverless, dedicated vector databases (Pinecone, pgvector), and a self-managed hybrid search layer. The decision weighs cost, p99 latency, permission-based filtering, incremental ingestion, and native Bedrock Knowledge Bases integration.design-docDesign Doc: Frontier Model Governance on Bedrock with GPT, Claude, and NovaThis document proposes an AI Gateway architecture to orchestrate and govern multiple frontier models — OpenAI GPT-5.5/GPT-4.5, Anthropic Claude, Amazon Nova, and specialized models — within Amazon Bedrock. The design covers intelligent routing, guardrails, prompt registry, inference logging, per-tenant IAM, data residency, and fallback policy, with a focus on auditability and cost control in enterprise environments.postmortemCoinbase (2026): The AWS MSK Control Plane That Froze TradingOn May 7, 2026, a defect in the Amazon MSK control plane prevented automatic partition leader re-election across two of Coinbase's managed Kafka clusters, silently blocking fee, quoting, and trade execution services for hours. The incident exposes the hidden risks of relying on managed services as single coordination points — and the critical need for deep observability into infrastructure you don't operate.postmortemCloudflare (2026): when a single-AZ dependency takes down an 'HA' clusterOn February 20, 2026, Cloudflare experienced a control plane and analytics outage because Kafka and ClickHouse — critical data ingestion and query services — existed only in zone PDX-04, while the cluster declared as highly available depended on them implicitly. The incident exposes a recurring pattern in distributed systems: the illusion of HA created by partial redundancy that does not cover the full dependency chain.adrADR: Aurora Sharding — App-Level vs Aurora Limitless vs CitusA high-growth OLTP workload exhausted the capacity of a single Aurora PostgreSQL writer. This ADR evaluates three sharding strategies — application-layer sharding, Aurora Limitless Database, and managed Citus/PostgreSQL — weighing operational complexity, cost, cross-shard query support, and migration risk.