Architecture: Zero Trust

A contractor joins for two weeks to fix a reporting dashboard. Someone in IT provisions a VPN account, the contractor connects, and the laptop picks up an address inside the corporate range. The dashboard loads. So does everything else. From that laptop the build servers answer. So does the internal wiki, the file share holding three years of payroll exports nobody archived, the printer management console, and a Jenkins instance last patched in 2… Read More

Architecture: Private NAT and Overlapping IP Ranges in AWS

Two teams, two projects, two VPCs. Neither team talked to the other about addressing, so both grabbed the obvious default: 10.0.0.0/16 . Everything worked fine in isolation. Then a business requirement lands: an application in VPC A needs to call a service in VPC B . You reach for VPC peering, and AWS rejects it. You reach for a Transit Gateway, attach both VPCs, and watch one of your routes silently vanish from the route table. The problem is not … Read More

Architecture: Amazon Bedrock AgentCore

On July 30, 2026, Amazon Bedrock Agents, the service AWS launched in 2023 for building tool-using AI agents, closes to new customers. AWS has renamed it Bedrock Agents Classic and pointed everyone at its successor. If your team demoed an agent prototype this quarter, someone is about to ask you what it should actually run on in production. The answer AWS wants you to reach is Amazon Bedrock AgentCore . That deadline is a good excuse to understand … Read More