Explained: Open Policy Agent

A new engineer asks who is allowed to delete an invoice. You say you will find out, which is the first sign of trouble. The answer lives in four places. There is a role check in the API gateway config. There is an if user.role == "admin" in the invoices service. There is a slightly different check in the nightly cleanup job, written a year later by someone who did not know about the first two. And there is a comment in the billing servi… Read More

Explained: BYOIP (Bring Your Own IP)

You already own your IP addresses. Here's why that matters in the cloud. You run a company with servers in three places: your own data center, a colocated facility, and now AWS. Your servers have used the same block of public IP addresses for years. Clients, partners, firewall allowlists, and DNS records all point at those IPs. Then you launch an EC2 instance and AWS hands you a fresh IP from its own pool. Fine for most workloads. But what if … Read More

Explained: CIDR

You spin up a VPC in AWS and it asks for a CIDR block. You type 10.0.0.0/16 because that's what the tutorial said. Then you create a subnet and it wants another one, so you put 10.0.1.0/24 . It works. You move on. Six months later somebody asks why the subnet can only hold 251 usable addresses when you asked for 256, and whether 10.0.1.0/24 overlaps with the 10.0.0.0/22 block the networking team just allocated. You don't know. Nobody does.… Read More

Explained: AWS Global Accelerator

The failover drill was supposed to take five minutes. At 2:00 a.m. the team failed the primary region on schedule, the Route 53 health check noticed within seconds, and the DNS answer flipped to the standby site exactly as designed. Twenty minutes later, the dashboards told a different story. Nearly half the clients were still connecting to the dead region. Nothing was misconfigured; every layer was doing exactly what it was built to do. The reco… Read More

Explained: Amazon Bedrock

Your product manager wants an AI feature. Nothing exotic: summarize support tickets, answer questions over internal docs. You prototype it against a model provider's API in an afternoon, and it works beautifully. Then the review starts. Security wants to know exactly where prompts and customer data go. Legal asks whether your data will be used to train someone else's model. Procurement wants three weeks to onboard a new vendor. Networkin… Read More