Blog category
Engineering guides on CI/CD pipelines, GitOps, Terraform, EKS with Karpenter, blue-green deployments, and infrastructure drift. Covers patterns our team uses in production across multi-account AWS environments.
On July 31, 2026 AWS shipped CloudWatch managed Prometheus collectors. For the AWS Example 22 shape (100 hosts x 50 metrics @ 60s), OTLP ingestion is $54/mo vs $1,500 classic custom metrics if you do not double-ingest.
Synthetics prove a journey works from AWS; RUM shows what real browsers experience — LCP, CLS, INP. Sampling, privacy, cost, and when Application Signals still owns backend SLOs.
Synthetics canaries catch user-journey failures before customers tweet — but a 1-minute canary fleet can quietly dominate the CloudWatch bill. Runtime, VPC, alarm wiring to Application Signals SLOs, and a reproducible checklist.
Monitoring is visibility; alerting is interruption. Teams with 40+ CloudWatch alarms and an actionable page rate under 50% are monitoring loudly and alerting poorly — fix ownership, SLO burn, and canaries before adding another metric.
Amazon Managed Grafana waste is rarely the $9 Editor seat itself — it is ten Editors who only view dashboards, orphan service accounts, and workspaces still on Grafana 9 while AWS shipped create + in-place upgrade to 12.4 in April/May 2026. Here is the workspace ops playbook: seats, IAM Identity Center, NAC/VPC, CMK, and a checklist you can run this week.
On a 120-stack AWS Organization, CloudFormation StackSets for platform baseline plus CDK for app teams cut org-wide guardrail rollout from 6 weeks to 2 — with Application Composer for spikes and Blocks for greenfield TypeScript only at preview.
On a 40-account AWS Organization, platform baseline via CloudFormation StackSets (Hooks, GuardDuty enroll) plus app teams on Terraform/OpenTofu cut org-wide guardrail rollout from 9 weeks to 3 — without forcing one tool for everything.
June 2026 benchmark on the same read-only AWS scaffold: OpenTofu 1.12 plan median 5.2s vs Pulumi 3.248 preview median 10.6s—plus when to pick HCL over TypeScript on landing zones.
Default Docker seccomp is not enough for regulated workloads. EKS Pod Security Standards, seccomp profiles, and Fargate platform version constraints.
Cluster upgrades and Karpenter consolidation look healthy in the console while PDB-blocked evictions freeze your node drain for 45 minutes. This guide wires minAvailable, maxUnavailable, and EKS managed node group semantics.
Ingesting every debug log to CloudWatch is how observability becomes a FinOps incident. Tail sampling with ADOT, Logs Insights, and Firehose to S3 for the long tail.
That `user_id` label on every HTTP metric turns Amazon Managed Prometheus into a five-figure line item. This guide explains cardinality mechanics, EMF vs remote write, and Application Signals defaults worth disabling.