Let’s talk
INSIGHTS / KNOWLEDGE, SHARED

Ideas for
your next move.

Practical thinking for teams building software, securing systems and operating modern infrastructure. Explore our engineering field notes.

500 insights · Page 21 of 42

DynamoDB TTL: Enforce Expiration Before Physical Deletion — conceptual 3D-style vector showing Item writer, Expiry attribute, Read validity, Application result, TTL worker, Stream deletion.ENGINEERING JOURNAL ↗
AWS Operations

DynamoDB TTL: Enforce Expiration Before Physical Deletion

Handle expired DynamoDB items safely by validating timestamp format, enforcing application expiry, and monitoring eventual TTL cleanup as a separate process.

Read field note ↗
Aurora Reader Endpoints: Check Connections and Consistency — conceptual 3D-style vector showing Application, Read pool, Reader endpoint, Replica A, Replica B, Writer endpoint, Writer.ENGINEERING JOURNAL ↗
AWS Operations

Aurora Reader Endpoints: Check Connections and Consistency

Explain uneven Aurora read traffic by tracing endpoint selection, connection-pool lifetime, replica membership, and business consistency needs.

Read field note ↗
RDS Blue/Green: Prove Readiness Before Switchover — conceptual 3D-style vector showing Blue production, Replication path, Green staging, Application test, Switchover guard, Resource-ID review.ENGINEERING JOURNAL ↗
AWS Operations

RDS Blue/Green: Prove Readiness Before Switchover

Prepare an RDS blue/green change with engine-specific replication checks, application tests, connection recovery, and a review of resource-ID dependencies.

Read field note ↗
RDS IAM Authentication: Match the Token and Database User — conceptual 3D-style vector showing Application role, Signed token, DB-user policy, RDS endpoint, Database account, TLS verification.ENGINEERING JOURNAL ↗
AWS Operations

RDS IAM Authentication: Match the Token and Database User

Diagnose RDS IAM database login failures by matching the caller, immutable resource ID, database username, endpoint, token freshness, and TLS settings.

Read field note ↗
RDS Proxy Pinning: Find the Session State That Persists — conceptual 3D-style vector showing Application pool, RDS Proxy, Reusable session, Pinned session, Database, Connection metrics.ENGINEERING JOURNAL ↗
AWS Operations

RDS Proxy Pinning: Find the Session State That Persists

Investigate RDS Proxy session pinning with connection metrics, database-session behavior, and a controlled workload before increasing database capacity.

Read field note ↗
S3 Object Lock: Inspect the Protected Object Version — conceptual 3D-style vector showing Object key, Version ledger, Retention mode, Legal hold, Delete marker, Audit review.ENGINEERING JOURNAL ↗
AWS Operations

S3 Object Lock: Inspect the Protected Object Version

Understand why a locked S3 object can disappear from a normal listing while its protected version remains, and verify retention separately from legal holds.

Read field note ↗
S3 Replication: Separate Live Copies from Backfill — conceptual 3D-style vector showing Source versions, Replication rule, New objects, Existing manifest, Batch job, Destination, Completion report.ENGINEERING JOURNAL ↗
AWS Operations

S3 Replication: Separate Live Copies from Backfill

Diagnose missing S3 replicas by checking object age, replication status, rule scope, and a reviewed Batch Replication manifest for existing data.

Read field note ↗
S3 Lifecycle: Explain Noncurrent Versions That Remain — conceptual 3D-style vector showing Object upload, Current version, Noncurrent versions, Age threshold, Version count, Expiration review.ENGINEERING JOURNAL ↗
AWS Operations

S3 Lifecycle: Explain Noncurrent Versions That Remain

Review S3 lifecycle filters, noncurrent age, retained-version counts, and delete markers before expecting versioned-bucket storage to decline.

Read field note ↗
EKS Access Entries: Verify Namespace Authorization — conceptual 3D-style vector showing IAM principal, Access entry, EKS policy, RBAC binding, Namespace, Audit event.ENGINEERING JOURNAL ↗
AWS Operations

EKS Access Entries: Verify Namespace Authorization

Separate EKS cluster authentication from Kubernetes authorization, then test the intended IAM principal, access policy, namespace scope, and RBAC bindings.

Read field note ↗
EKS Pod Identity or IRSA: Verify Credential Selection — conceptual 3D-style vector showing Service account, Credential chain, Pod Identity agent, OIDC token, IAM role, AWS resource.ENGINEERING JOURNAL ↗
AWS Operations

EKS Pod Identity or IRSA: Verify Credential Selection

Choose EKS workload identity using node support, SDK compatibility, service-account mapping, and proof that the application assumes the intended role.

Read field note ↗
ECS Capacity Providers: Explain Tasks Stuck Provisioning — conceptual 3D-style vector showing Task requirements, Capacity strategy, Scaling signal, Auto Scaling group, Registered instance, Placement.ENGINEERING JOURNAL ↗
AWS Operations

ECS Capacity Providers: Explain Tasks Stuck Provisioning

Trace ECS capacity-provider selection, smallest-instance fit, Auto Scaling limits, and registration before changing managed scaling for provisioning tasks.

Read field note ↗
ECS Exec: Verify the Task, Agent and Session Permissions — conceptual 3D-style vector showing Operator, ECS authorization, Managed agent, Task role, Session channel, Audit log.ENGINEERING JOURNAL ↗
AWS Operations

ECS Exec: Verify the Task, Agent and Session Permissions

Enable ECS Exec through a reviewed task rollout, then verify the managed agent, task-role channel permissions, network path, and operator access.

Read field note ↗