Let’s talk
INSIGHTS / KNOWLEDGE, SHARED

Ideas for
your next move.

Practical thinking for teams building software, securing systems and operating modern infrastructure. Explore our engineering field notes.

500 insights · Page 19 of 42

CloudFormation drift: understand what was compared — conceptual 3D-style vector showing Stack template, Declared properties, Live resources, Drift detection, Change owner, Reconciliation plan.ENGINEERING JOURNAL ↗
AWS Operations

CloudFormation drift: understand what was compared

Interpret CloudFormation drift results using supported resource properties, explicit template values, nested-stack scope and the operational intent of manual changes.

Read field note ↗
AWS RAM shares: check acceptance and consumer permissions — conceptual 3D-style vector showing Resource owner, RAM resource share, Consumer account, Invitation state, Consumer IAM, Shared resource.ENGINEERING JOURNAL ↗
AWS Operations

AWS RAM shares: check acceptance and consumer permissions

Investigate an invisible or unusable shared AWS resource by checking share scope, invitation state, resource association and consumer identity.

Read field note ↗
PrivateLink interface endpoints: verify DNS and traffic — conceptual 3D-style vector showing VPC workload, Private DNS, Endpoint interfaces, Endpoint policy, AWS service.ENGINEERING JOURNAL ↗
AWS Operations

PrivateLink interface endpoints: verify DNS and traffic

Trace an AWS service request through private DNS, endpoint network interfaces, security groups and endpoint policy before widening network access.

Read field note ↗
Cost Allocation Tags: Verify Activation and History — conceptual 3D-style vector showing Resource tags, Activated key, Historical presence, Billing refresh, Cost report, Allocation owner.ENGINEERING JOURNAL ↗
AWS Operations

Cost Allocation Tags: Verify Activation and History

Turn resource tags into usable AWS cost dimensions by checking key activation, historical tag presence, backfill scope, and refreshed billing data.

Read field note ↗
Auto Scaling Hooks: Resolve Instances Waiting on Lifecycle — conceptual 3D-style vector showing Instance launch, Lifecycle wait, Automation event, Bootstrap action, Completion decision, Application readiness.ENGINEERING JOURNAL ↗
AWS Operations

Auto Scaling Hooks: Resolve Instances Waiting on Lifecycle

Trace Auto Scaling lifecycle waits through event delivery, hook identity, heartbeat deadlines, completion results, and application readiness evidence.

Read field note ↗
Spot Interruptions: Verify Checkpoints Before the Notice — conceptual 3D-style vector showing Spot worker, Interruption signal, Stop new work, Durable checkpoint, Replacement worker, Completion ledger.ENGINEERING JOURNAL ↗
AWS Operations

Spot Interruptions: Verify Checkpoints Before the Notice

Prepare Spot workloads with durable progress, interruption signals, bounded draining, and recovery tests that do not depend on advance warning.

Read field note ↗
EC2 IMDSv2: Verify Software and Container Reachability — conceptual 3D-style vector showing Application SDK, Container network, Token response hops, IMDS endpoint, Usage metrics, Launch template.ENGINEERING JOURNAL ↗
AWS Operations

EC2 IMDSv2: Verify Software and Container Reachability

Migrate EC2 workloads to IMDSv2 using usage evidence, compatible software, container-path testing, and launch-template checks for replacement instances.

Read field note ↗
Organizations SCPs: Trace an Inherited Access Denial — conceptual 3D-style vector showing Organization root, Parent OU, Workload account, IAM role, Resource action, Policy evidence.ENGINEERING JOURNAL ↗
AWS Operations

Organizations SCPs: Trace an Inherited Access Denial

Investigate an AWS Organizations denial by walking root, OU and account policies, then test a narrow correction without confusing SCP limits with IAM grants.

Read field note ↗
AWS Config Recorder: Explain Missing Resource History — conceptual 3D-style vector showing Account and Region, Recorder scope, Resource change, Configuration item, Delivery channel, History review.ENGINEERING JOURNAL ↗
AWS Operations

AWS Config Recorder: Explain Missing Resource History

Diagnose missing AWS Config history by checking account and Region, recorder status, inclusion or exclusion strategy, global-resource placement, and delivery.

Read field note ↗
AWS WAF Logs: Verify Filtering and Data Protection — conceptual 3D-style vector showing Web request, Web ACL evaluation, Data protection, Logging filter, Log destination, Request samples.ENGINEERING JOURNAL ↗
AWS Operations

AWS WAF Logs: Verify Filtering and Data Protection

Check AWS WAF log completeness and sensitive-field handling by separating logging filters, redaction, sampled requests, and web ACL data protection.

Read field note ↗
API Gateway REST Throttles: Find the Effective Limit — conceptual 3D-style vector showing API client, Usage plan, Method settings, Regional account pool, Backend, Backoff clock.ENGINEERING JOURNAL ↗
AWS Operations

API Gateway REST Throttles: Find the Effective Limit

Diagnose REST API 429 responses by comparing usage-plan, method, stage, account and backend evidence, then verify client backoff and capacity.

Read field note ↗
Kinesis Consumer Lag: Separate Reading from Processing — conceptual 3D-style vector showing Producer stream, Shard reads, Consumer lease, Record processor, Downstream system, Lag versus retention.ENGINEERING JOURNAL ↗
AWS Operations

Kinesis Consumer Lag: Separate Reading from Processing

Investigate Kinesis backlog by comparing per-consumer lag, shard distribution, shared read limits, processing duration, and the remaining retention window.

Read field note ↗