Tag: aws

Prowler finds AWS misconfigurations. This guide covers who remediates findings, IaC fix patterns, Security Hub workflows, and when to bring in AWS security consulting.

Production checklist for Prowler and AWS Security Hub — multi-account setup, scheduled scans, finding workflows, and remediation patterns on AWS.

AWS shipped ECS Express Mode on November 21, 2025 — three inputs (image + two IAM roles) and Express Mode provisions Fargate, ALB, HTTPS, auto scaling, and a *.ecs.*.on.aws URL. Up to 25 services can share one ALB. No Express Mode surcharge.

AWS Blocks (public preview, June 2026): 18+ open-source TypeScript building blocks that run locally without an AWS account and deploy with zero code changes.

On June 15, 2026 AWS made Console Private Access work without internet — VPC endpoints route 100% of browser traffic. First-party benchmark: 161 interface endpoints and ~$263/mo for a 12-service 3-AZ pilot in us-east-1.

Bloom filters shave 90% of negative lookups; HyperLogLog estimates cardinality without storing every user ID. Redis modules on ElastiCache for abuse detection and feed deduplication.

Why Aurora PostgreSQL loves B-tree indexes on OLTP but DynamoDB feels like an LSM—and how cost-based optimization surprises you when statistics go stale on RDS.

CAP is not a trivia question—it is the reason your global DynamoDB table shows stale inventory or why Aurora Global reads lag 80 ms behind the writer. This guide maps partition tolerance, consistency, and availability trade-offs to concrete AWS controls.

You rarely implement Raft on EC2—you buy it in Aurora, DynamoDB, and EKS etcd. This guide explains quorum math so you trust managed services and avoid rolling your own coordinator.

Default Docker seccomp is not enough for regulated workloads. EKS Pod Security Standards, seccomp profiles, and Fargate platform version constraints.

Two goroutines updating adjacent counters can saturate memory bus on a c7g.8xlarge. Memory barriers, cache lines, and false sharing—why placement groups do not fix application-level contention.

Last-write-wins is not a CRDT—it is how Global Tables lose cart merges. When to use counters, OR-Sets, and conflict-free merges vs when to keep a single Aurora writer.