A clean content hub for AWS patterns, GenAI production notes, architecture diagrams, and failure-mode thinking.
Where Lambda, SQS, Step Functions and MCP clients re-run an agent tool, where the Powertools idempotency decorator stops, and how to make the write check a key.
A six-step red-team method for Bedrock and AgentCore agents, built on OWASP, NIST, MITRE ATLAS and AWS guidance, with a worked example on a public reference build.
With Converse tool use, a Bedrock guardrail skips tool results, tool definitions and tool-call arguments. Where indirect injection enters, where data leaves, and the controls that still run.
Fit a multi-tenant task tracker inside DynamoDB's 25 free read and write capacity units, with the cost of each access pattern and when on-demand wins.
A bookmarks API on a Lambda function URL and DynamoDB: which free limit runs out first, what a traffic flood can cost, and settings that break $0.
Two order Lambda functions as agent tools behind Cognito tokens and a Cedar policy, with the tool schema limits, a tested CDK stack and the monthly math.
The 2025 Free Tier rules in plain terms, plus a tested CDK stack that emails you at the first cent and blocks new paid resources at your limit.
A tested Lambda gateway that checks each user's daily budget in DynamoDB before it calls Claude, plus the caching settings and the monthly math.
Both side by side in a tested CDK repo. A Secrets Manager secret costs $0.40 a month; a standard SecureString costs nothing to store.
Where each AI agent permission rule belongs: tool code, a gateway policy engine such as AgentCore Policy with Cedar, IAM, or a human approval step, and why the system prompt is not one of them.
A two-tier CI gate for AI agents: deterministic checks on every pull request, real-model runs with pass^k trials when prompts, tools or models change, and where AgentCore Evaluations fits.
Markdown in S3 turned into answers with sources using S3 Vectors, Titan embeddings and Nova Micro, plus monthly costs at 100,000 and 10 million chunks.
A tested CDK app on the new EventBridge bus: per-order sequencing, a FIFO subscriber feeding DynamoDB, the PutEvents trap, dedup rules and cost math.
Every policy in a CDK app goes to IAM Access Analyzer on each pull request, so new access or a public bucket fails the build, for $0.014 a run.
A document upload pipeline where the Lambda functions can't reach the internet at all. It uses free gateway endpoints instead of a NAT gateway, costs about $9 a month, and comes with tested CDK code you can deploy.
Five root causes I see across every cost engagement, ranked by how often they show up, plus what fixes actually work and in what order.
Real shortlist criteria from CTO conversations. The five questions that separate production architects from cert-only contractors.
Solo senior architect vs AWS consultancy vs full-time hire: side-by-side on speed, cost, scope, bus factor, and when each is the right call.
Routing S3 events through CloudTrail data events pays per event for plumbing S3 provides free, and at volume per-object KMS requests cost more than the compute. The cost model and the three configuration fixes.
CodePipeline, CodeDeploy, and Auto Scaling in CDK: VPC, ALB, ASG, SSM config, and the lifecycle hook settings that keep deploys clean under real load.
The full web-app stack most tutorials skip: VPC isolation, Fargate on private subnets, Aurora with KMS, CloudFront, secret rotation, and the six operational gaps that page you at 2am.
A production CDK stack enforcing KMS encryption, least-privilege IAM, VPC endpoint routing for secrets, WAFv2 on CloudFront and API Gateway, and Security Hub, all versioned and testable.
Coordinating DataSync, DMS, Glue, and OpenSearch under one Step Functions control plane, and exactly where incomplete data sneaks through if you skip the readiness checks.
Start with a fixed-scope production review, or book a free 30-minute fit call if you are not sure yet.