AWS CDK Reference Architectures

Amazon ECS Gateway: shared ingress owned by the platform team, opted into by services

Fri, 23 Oct 2026 12:00:00 GMT

Two Amazon ECS Gateways (internet-facing with WAF, access logs and its own inbound security group; internal) are associated with one cluster, and Fargate services opt in with a gateway connector only. ECS provisions the shared ALBs, per-service ACM certificates, *.ecs..on.aws hostnames, listener rules and target groups. Written with CfnResource because aws-cdk-lib has no L1 yet.

AWS WAF mitigations for PHP2Shell (CVE-2026-109618 / 109619) verified on CloudFront and ALB

Thu, 22 Oct 2026 12:00:00 GMT

The four AWS WAF custom rules from the AWS Security Blog applied to both CloudFront (body inspection raised to 64 KB) and an ALB (fixed 8 KB) in front of a patched PHP-FPM 8.4.27 origin on a Lambda container image. Deploy-verified: rule conditions, the exact 8 / 16 / 64 KB inspection boundaries, false positives, per-layer oversize thresholds, rate-rule lag, origin lockdown with the CloudFront prefix list and a shared-secret header, and Count headers echoed by the origin.

Human-in-the-loop approval workflow on Lambda durable functions

Wed, 21 Oct 2026 12:00:00 GMT

A submit / approve / expire business flow written as one Lambda durable function: executions start asynchronously with an idempotent DurableExecutionName through a published-version alias, wait up to 48 hours for an approver with waitForCallback (no compute while suspended) and resume from checkpoints when the decision API sends the callback. Shows the durable-specific rules in code and infrastructure: deterministic replay, retained versions for in-flight executions, at-least-once steps with conditional DynamoDB writes, a DynamoDB status projection instead of the 30 rps GetDurableExecution API, and failure detection through EventBridge status-change events plus a DLQ. Deploy-verified, including the observation that an asynchronous retry with a different payload is not rejected but lands in the DLQ. An optional demo web UI (Cognito managed login, identity pool roles per group, CloudFront + S3) calls the same IAM-authorized API with SigV4.

Lambda Web Functions (Express.js) behind CloudFront + OAC

Thu, 15 Oct 2026 12:00:00 GMT

The same Todos REST API as the apigw-* series, served by a plain Express.js server running as an AWS Lambda Web Function: no API Gateway, no adapter, no handler. The IamAuth endpoint only accepts CloudFront OAC-signed requests and WAF sits on CloudFront. Deploy-verified: multi-concurrency (100 requests on 3 environments once warm), dynamic per-environment limits vs maxEnvironments throttling, SSE through CloudFront, 90/10 canary weights, a zero-error revision rollout, optional VPC egress through a network connector, and a head-to-head run against the API Gateway + Lambda Web Adapter version.

ECS Blue/Green: Native versus CodeDeploy

Sat, 10 Oct 2026 12:00:00 GMT

The same application deployed blue/green with native ECS (deploymentStrategy BLUE_GREEN) and with CodeDeploy, side by side behind ALBs with a production and a test listener, and driven through the same four deployments: a good release, a failing lifecycle hook, a rollback during the bake period and a container that never starts. Deploy-verified with a 5 requests-per-second probe: no HTTP error on either flavor, rollback to the old version in 20 s (native) and 14 s (CodeDeploy), and neither gave up on the broken release within 7 minutes.

RDS Multi-AZ versus a Read Replica

Sat, 10 Oct 2026 12:00:00 GMT

The two RDS features people confuse most, side by side on one PostgreSQL database and measured by a probe Lambda in the VPC: the Multi-AZ standby is invisible and synchronous, the replica is readable and asynchronous (median 7 ms behind), refuses writes, survives a Multi-AZ failover of the primary (13 s write outage, 0 s read outage) and, once promoted, is an independent database. Documents why the ReplicaLag metric climbs on an idle PostgreSQL primary and what a heartbeat does to it.

Data Lake with AWS Glue and Amazon Athena

Sat, 10 Oct 2026 12:00:00 GMT

Raw CSV to cleaned, de-duplicated, partitioned Parquet with a Glue workflow (crawler, Spark job, crawler), queried with an Athena workgroup that enforces encrypted results and a per-query scan limit. Deploy-verified with generated data: 59,770 valid orders from 60,600 raw rows, Parquet scanning 7% of the CSV bytes, partition pruning, and an idempotent rerun when a new day arrives. Documents why a crawler's string partition key rejects DATE literals.

Bedrock Knowledge Base RAG on Amazon S3 Vectors

Sat, 10 Oct 2026 12:00:00 GMT

A retrieval-augmented generation API on Amazon Bedrock Knowledge Bases with S3 Vectors as the vector store, so there is no idle vector cluster. A SigV4-signed HTTP API answers with citations, filters by a metadata attribute, keeps a conversation through a session ID and exposes retrieval alone for tuning. Deploy-verified with golden questions, an out-of-corpus question, the metadata filter and a follow-up turn; about 0.5 s per retrieval and 1.8 s per answer. Documents why Bedrock's chunk-text keys must be non-filterable and why a caller-supplied filter is not access control.

Security Baseline: CloudTrail, Config, GuardDuty, Access Analyzer & Security Hub

Sat, 10 Oct 2026 12:00:00 GMT

A single-account security baseline in one CDK stack, with opt-in automatic remediation: a multi-Region CloudTrail trail and AWS Config recorder with managed rules delivering to a hardened S3 log archive, a GuardDuty detector with optional protection plans, IAM Access Analyzer, and Security Hub subscribed to AWS Foundational Security Best Practices, with new high-severity findings emailed through EventBridge and SNS. Deploy-verified end-to-end; the Config recorder/delivery channel are created via AwsCustomResource to work around a CloudFormation circular-dependency limitation. Automatic remediation (dry-run by default, skip tag) blocks S3 public access, revokes open SSH/RDP rules and isolates GuardDuty-flagged EC2 instances; verified with real resources and Security Hub findings.

code-server on EC2 vs AWS Lambda MicroVMs: The Same Browser IDE on Two Compute Models, with Claude Code on Bedrock

Thu, 08 Oct 2026 12:00:00 GMT

VS Code in the browser (code-server) on two compute models in one CDK app: an always-on EC2 instance behind CloudFront, and an on-demand AWS Lambda MicroVM that suspends when idle. A local relay injects the X-aws-proxy-auth token so a browser can reach the MicroVM endpoint, including WebSockets. Claude Code (CLI and extension) is wired to Amazon Bedrock through role credentials on both. Deploy-verified: MicroVM start in 3 to 16 seconds, resume after suspend in 0.65 seconds.

Transfer Family SFTP with a Custom Identity Provider: SSH Key Auth + Source IP Allow List

Tue, 06 Oct 2026 12:00:00 GMT

An AWS Transfer Family SFTP server on a PUBLIC endpoint where a Lambda custom identity provider authenticates SSH public keys from a DynamoDB user table (AWS custom IdP solution layout) and rejects logins from IPs outside each user's allow list. Per-user S3 isolation via LOGICAL home directories and a session policy, CloudShell shell scripts for user and key management, fail-closed behavior, three run modes (always on, scheduled, manual: the server is deleted while off because a stopped server is still billed), and alarms with SNS for auth failures, IP denials, IdP errors and transfer volume. Deploy-verified with 31 real SFTP checks.

Transit Gateway Centralized Inspection with AWS Network Firewall

Sun, 04 Oct 2026 12:00:00 GMT

One AWS Network Firewall inspects both internet-bound and east-west traffic of two spoke VPCs that have no internet route of their own: a Transit Gateway with two route tables and an appliance-mode attachment hands every flow to an inspection VPC, where a domain allow list, east-west pass/drop rules and a NAT gateway apply. Deploy-verified over SSM: allowed domain 200, other domain blocked, east-west TCP passes, east-west ICMP dropped, both drops in the alert log. Documents why a domain allow list also drops east-west HTTP unless a pass rule precedes it.

Multi-Region Disaster Recovery: Four Strategies Compared

Sun, 04 Oct 2026 12:00:00 GMT

The four AWS disaster recovery strategies (backup and restore, pilot light, warm standby, multi-site active-active) built for the same orders API in Tokyo and Osaka and measured with a drill script. Global tables replicate in about 1 s; measured RTO is about 34 s (active-active), 36 s (warm standby), 84 s (pilot light) and 6 minutes or more (backup and restore). Includes a strategy decision guide and idle-cost comparison.

Route 53 Failover Routing with Health Checks

Sat, 03 Oct 2026 12:00:00 GMT

DNS failover in its basic form: a PRIMARY record guarded by a Route 53 health check and a SECONDARY record that takes over when it fails, with two Lambda function URLs as endpoints and no domain or load balancer needed. A resolver Lambda inside the VPC resolves the private-zone record, and a check script breaks the primary and measures the switch. Deploy-verified: failover in 29 s and failback in 18 s with a 10 s interval, threshold 2 and TTL 10 s.

API Gateway REST API to a Private ALB over a VPC Link (ECS Fargate)

Sat, 03 Oct 2026 12:00:00 GMT

Publish a private ECS Fargate service only through API Gateway: a REST API with API key, usage plan and throttling reaches an internal ALB through a VPC link v2 with no NLB in between. The ALB's security group accepts the VPC link only, so the API key cannot be bypassed. Deploy-verified end to end with a check script: 403 without a key, 200 through the VPC link, load spread across tasks, ALB unreachable from outside, 429 under burst.

FIS Chaos: RDS Multi-AZ DB Instance vs. Multi-AZ DB Cluster (PostgreSQL)

Fri, 02 Oct 2026 12:00:00 GMT

Three AWS FIS chaos experiment templates comparing the two plain-RDS Multi-AZ topologies: forced failover of a Multi-AZ DB instance (aws:rds:reboot-db-instances, forceFailover=true), failover of a Multi-AZ DB cluster (aws:rds:failover-db-cluster), and a no-failover reboot as the control group. A VPC probe Lambda opens a new PostgreSQL connection per second to both endpoints and reports client-visible outage windows and server-IP changes. Deploy-verified: ~13-14 s for both failovers, 7 s for the plain reboot on idle small DBs.

Serverless Codex App Server on AWS Lambda MicroVMs

Sun, 27 Sep 2026 12:00:00 GMT

An on-demand, VM-isolated Codex App Server per session on AWS Lambda MicroVMs: a control plane of 10 Lambda functions (7 HTTP + 3 WebSocket) brokers session lifecycle, and output is delivered by both polling and a WebSocket push path. The MicroVM image and network connector are defined in CloudFormation. Deploy-verified end-to-end (session creation through a real codex app-server JSON-RPC handshake and DynamoDB event persistence), with 6 real bugs found and fixed.

S3 + Amplify Static Website Hosting

Sun, 27 Sep 2026 12:00:00 GMT

Static website hosting with AWS Amplify Hosting in manual deployment mode (no Git connection): site files are packaged as a CDK asset, and a Lambda-backed custom resource presigns an S3 URL for the zip and calls StartDeployment with it, avoiding a bucket policy on the shared CDK bootstrap bucket. Compared against the CloudFront + S3 pattern. Deploy-verified end-to-end, including a live HTTP 200 from the deployed site.

AWS Service EOL Monitor — Serverless EOL Watch with a Bedrock Digest

Sun, 27 Sep 2026 12:00:00 GMT

A serverless pipeline that watches the awslabs/aws-service-eol-data dataset for AWS service/version end-of-life changes: EventBridge Scheduler triggers a Standard Step Functions workflow that diffs the dataset against a DynamoDB state table, asks Bedrock (Claude) to draft a prioritized Markdown digest only when something changed, and publishes it to SNS. Deploy-verified end-to-end, including a real Bedrock ConverseCommand call and SNS publish.

ECS Fargate with ALB (CliCredentialsStackSynthesizer / PermissionsBoundary variant)

Sat, 26 Sep 2026 12:00:00 GMT

A variant of the ECS Fargate + ALB reference for accounts that govern IAM with permissions boundaries: with CDK_USE_CALLER_ROLE=true it deploys via CliCredentialsStackSynthesizer instead of the bootstrap roles, and CDK_PERMISSIONS_BOUNDARY_POLICY_NAME applies a custom boundary (default: PowerUserAccess) to every IAM role in the stage. Deploy-verified, including a boundary on cfn-exec-role that denies roles created without it.

Secrets Manager Rotation for Aurora (Single-User and Alternating Users)

Fri, 25 Sep 2026 12:00:00 GMT

Automatic credential rotation for Aurora PostgreSQL Serverless v2 with Secrets Manager hosted rotation: single-user rotation for the master secret and alternating-user rotation for the application secret, in isolated subnets with a Secrets Manager interface endpoint instead of a NAT gateway. A Data API consumer never holds a password; an end-to-end script runs real rotations and proves the new credentials work with zero failed queries.

EventBridge Custom Bus: Content-Based Routing with Archive & Replay

Fri, 25 Sep 2026 12:00:00 GMT

A custom Amazon EventBridge bus for an order domain: rules route by content (numeric, prefix, anything-but) to SQS with an input transformer, Lambda, and CloudWatch Logs directly, with bounded retries plus a DLQ, bus-level logging (source, destination and delivery), and a replayable archive. Includes an end-to-end script that proves which events land where, and which land nowhere.

Cognito + API Gateway Authentication & Authorization

Fri, 25 Sep 2026 12:00:00 GMT

Protect a REST API with Amazon Cognito: a user pool (groups, optional TOTP MFA, hosted UI with authorization code + PKCE, machine client via client_credentials), an API Gateway Cognito authorizer with per-method OAuth scopes, and Lambda functions enforcing group membership and per-user data ownership. The managed counterpart to the Keycloak pattern, with an end-to-end token-type and scope check script.

CDK Pipelines: Self-Mutating Pipeline with Dev/Prod Promotion

Fri, 25 Sep 2026 12:00:00 GMT

A self-mutating CDK Pipeline (aws-cdk-lib/pipelines) sourced from CodeCommit: the pipeline definition lives in the repository it builds, so a commit that changes the pipeline updates the pipeline itself. Build runs tsc + unit tests + CDK Nag, then Dev deploy with a smoke test, a manual approval, and Prod deploy. Includes an end-to-end check script that proves release and self-mutation.

Semantic Search API with DynamoDB Native Vector Search

Fri, 25 Sep 2026 12:00:00 GMT

A meaning-based search API on Amazon DynamoDB's native vector index (no OpenSearch): DynamoDB Streams triggers a Lambda that embeds each document with Bedrock Titan Text Embeddings V2, and SearchVectors with an inline category filter answers natural-language queries. Includes the CDK escape hatch for VectorIndexes and an end-to-end check script.

ALB OIDC Authentication with Keycloak on ECS Fargate + Aurora Serverless

Sun, 20 Sep 2026 12:00:00 GMT

AWS ALB built-in OIDC authentication backed by Keycloak running on ECS Fargate with Aurora Serverless V2 (PostgreSQL) as the session store. Two patterns: Pattern A uses Keycloak as a direct OIDC provider; Pattern B adds SAML identity brokering so Keycloak acts as both an OIDC provider to ALB and a SAML service provider to a corporate IdP. Includes setup scripts for realm/client configuration and ECS Exec enabled for connection testing.

FIS Chaos: SQS + Lambda Event-Driven Consumer + DynamoDB

Sun, 20 Sep 2026 12:00:00 GMT

Three AWS FIS chaos experiment templates for a serverless event-driven consumer, using the aws:lambda:function action family via the FIS Lambda extension: a 5-min invocation-error outage (short recovery), a 20-min invocation-error outage (forces DLQ routing past the visibility-timeout × maxReceiveCount threshold), and a 10-min invocation-add-delay throughput collapse — each with a CloudWatch Alarm stop condition on queue backlog depth.

FIS Chaos: Step Functions Saga + Lambda + DynamoDB

Sun, 20 Sep 2026 12:00:00 GMT

Three AWS FIS chaos experiment templates for a Saga-pattern order workflow (Reserve Inventory → Process Payment → Confirm Order, each with Retry/Catch and compensating transactions): payment-step outage triggering inventory-release compensation, first-step outage with no compensation needed, and final-step outage triggering the two-stage refund-then-release compensation chain — each with a CloudWatch Alarm stop condition on Step Functions ExecutionsFailed. Uses the aws:lambda:function action family (invocation-error) via the FIS Lambda extension to drive Saga error handling indirectly, since FIS has no native Step Functions action.

FIS Chaos: Multi-AZ Network Disruption — NLB + EC2 ASG + Aurora

Sun, 20 Sep 2026 12:00:00 GMT

Four AWS FIS chaos experiment templates for a Multi-AZ resilient architecture: cross-AZ connectivity disruption (VPC-internal traffic only), full AZ isolation (all traffic blocked), Aurora writer→reader failover, and tagged EC2 instance termination — each with a CloudWatch Alarm stop condition on NLB UnHealthyHostCount. Centers on aws:network:disrupt-connectivity, the only FIS action for simulating AZ-level network partitions.

FIS Chaos: ARC Zonal Shift on Auto Scaling

Sun, 20 Sep 2026 12:00:00 GMT

A direct follow-up to Architecture G's G-2 finding (Auto Scaling re-launches instances into the same network-partitioned AZ): the same NLB + EC2 ASG + Aurora Multi-AZ base, with the ASG registered for ARC zonal shift (AvailabilityZoneImpairmentPolicy). Deploy-verified, in the same live infrastructure, both with and without an active operator-triggered zonal shift: without it, the replacement lands back in the same broken AZ (reproducing G-2); with ReplaceUnhealthy active, it lands in the healthy AZ instead.

Amazon Bedrock Agentic Code Review Gate for ECS Fargate CI/CD (ecspresso + CodePipeline)

Sat, 19 Sep 2026 12:00:00 GMT

A CodeCommit/CodePipeline CI/CD reference for ECS Fargate that adds an Amazon Bedrock agentic code review gate between Build and Deploy: security/infra/quality/cost perspectives are reviewed in parallel against each push's git diff, and the pipeline blocks when the aggregated risk level reaches a configurable threshold. Deploys sample task/service definitions with ecspresso + jsonnet; this workspace has no real ECS cluster/service, so the Deploy stage only runs `ecspresso render` (no AWS API calls).

Cross-Account CI/CD from a Single CodeCommit Repository

Thu, 10 Sep 2026 12:00:00 GMT

One CodeCommit repository in the dev account feeding three CodePipelines, each deployed into its own account (dev/stg/prd); only the Source stage crosses accounts, assuming a fixed-name IAM role while EventBridge forwards push events across accounts to trigger each pipeline.

FIS Chaos: CloudFront + Internal ALB + ECS Fargate + Aurora PostgreSQL

Tue, 08 Sep 2026 12:00:00 GMT

Four AWS FIS chaos experiment templates for a container-based three-tier web architecture: Aurora writer→reader failover, ECS all-tasks stop (with CloudFront S3 fallback), ECS→DB network blackhole on TCP 5432, and ALB→ECS network blackhole on TCP 80 — each with an ALB 5xx CloudWatch Alarm stop condition.

FIS Chaos: CloudFront + Internal ALB + EC2 Auto Scaling Group + Aurora PostgreSQL

Tue, 08 Sep 2026 12:00:00 GMT

Four AWS FIS chaos experiment templates for an EC2-based three-tier web architecture: EC2 instance termination (50% PERCENT), CPU stress via SSM (all instances, 5 min), Aurora writer→reader failover, and EC2→DB network blackhole on TCP port 5432 — each with an ALB 5xx CloudWatch Alarm stop condition.

FIS Chaos: CloudFront + API Gateway + Lambda + DynamoDB

Tue, 08 Sep 2026 12:00:00 GMT

Four AWS FIS chaos experiment templates for a serverless CRUD API: DynamoDB internal errors (all ops), write-only throttle, read-only throttle, and Lambda concurrency exhaustion — each with a CloudWatch Alarm stop condition. Uses aws:fis:inject-api-* targeting the Lambda execution role to intercept DynamoDB calls at the control plane without touching function code.

API Gateway + Single-Purpose Lambda

Mon, 07 Sep 2026 12:00:00 GMT

A Todos REST API where every API Gateway method is backed by its own narrowly-scoped Lambda function, each with an independent IAM role, log group, bundle, and least-privilege DynamoDB grant (read-only for GET, write-only for POST/DELETE). One of three companion workspaces comparing API Gateway + Lambda integration styles against the same API.

API Gateway + Lambdalith (Hono)

Mon, 07 Sep 2026 12:00:00 GMT

The same Todos REST API served by a single Lambda function, with routing done in-process by the Hono framework via its aws-lambda adapter and API Gateway reduced to a thin {proxy+} pass-through. One of three companion workspaces comparing API Gateway + Lambda integration styles against the same API.

API Gateway + Lambda Web Adapter (Express.js)

Mon, 07 Sep 2026 12:00:00 GMT

The same Todos REST API served by a single Lambda that runs a standard Express.js HTTP server, with the AWS Lambda Web Adapter layer translating the API Gateway proxy event into a real HTTP request so the identical image also runs on Fargate or a local node process. One of three companion workspaces comparing API Gateway + Lambda integration styles against the same API.

Route 53 Private Hosted Zone Delegation

Mon, 31 Aug 2026 12:00:00 GMT

Parent private hosted zone system.example.com delegates dev.system.example.com and stg.system.example.com to two child VPCs using the June 2025 Route 53 Resolver DNS delegation feature (INBOUND_DELEGATION endpoints + DELEGATE resolver rules), with a fourth on-premises-role VPC and all four VPCs joined by one Transit Gateway.

Route 53 Resolver Inbound/Outbound Endpoints

Mon, 31 Aug 2026 12:00:00 GMT

A verification VPC with the system.example.com private hosted zone and both a Resolver inbound endpoint (switchable via parameter between the default and the June 2025 INBOUND_DELEGATION type) and outbound endpoint, peered with an on-premises-role VPC running a BIND9 DNS server.

Multi-VPC Transit Gateway

Sat, 29 Aug 2026 12:00:00 GMT

Three VPCs (10.0/16, 10.1/16, 10.2/16) joined into a full mesh by one Transit Gateway with a single, explicitly managed TGW route table (association + propagation on every attachment), plus one SSM-managed test instance per VPC for connectivity verification.

AWS Backup Cross-Region (Tokyo to Osaka)

Fri, 21 Aug 2026 12:00:00 GMT

A single tag-based AWS Backup Selection protecting a sample EC2 instance, RDS database, S3 bucket, and an entire CloudFormation stack in Tokyo, with every recovery point copied cross-region to a pre-created secondary vault in Osaka.

ECR Cross-Region Replication

Thu, 20 Aug 2026 12:00:00 GMT

Amazon ECR cross-region replication from Tokyo to Osaka, with both repositories pre-created and independently lifecycle-managed so the replica keeps its own retention policy instead of inheriting none.

WAF Log Reporting

Sun, 16 Aug 2026 12:00:00 GMT

Daily WAF Count/Block activity reports built two ways from the same logs: CloudWatch Logs Insights + Lambda + SNS, and Athena + Lambda + SNS, either against a standalone sample Web ACL or an existing WAF.

EC2 Dual ENI

Thu, 13 Aug 2026 12:00:00 GMT

Single EC2 instance with two network interfaces: eth0 for internet-facing HTTP/HTTPS traffic (with Elastic IP), and eth1 for SSH management access restricted to specific CIDRs.

API Gateway + S3 Stub API

Sat, 08 Aug 2026 12:00:00 GMT

Build a Lambda-free mock/stub HTTP API by wiring API Gateway directly to S3 via an AWS Service integration, returning canned JSON files.

SNS Basic Fan-Out Patterns

Sat, 08 Aug 2026 12:00:00 GMT

A single SNS topic fanned out to Email, SQS, Lambda, HTTPS (API Gateway to S3/DynamoDB) and Firehose subscriptions, plus a CloudWatch Logs to Lambda to SNS to Lambda alerting chain.

CloudFront S3 Static Website

Wed, 05 Aug 2026 12:00:00 GMT

A static site served over HTTPS by CloudFront from a fully private S3 bucket (Origin Access Control), with a Content-Security-Policy response-headers policy, SPA-friendly 403/404-to-index rewrites, and an optional cross-region (us-east-1) WAFv2 Web ACL with an IP allow-list and redacted log fields.

S3 Static Web Site

Wed, 05 Aug 2026 12:00:00 GMT

The simplest static website on AWS: S3 static website hosting served straight from the bucket website endpoint, with Block Public Access left fully enabled and anonymous access limited to an allow-list of IPv4/IPv6 addresses via an aws:SourceIp bucket policy (auto-detecting the deploying operator's own global IP).

CI/CD Pipeline for CloudFront & S3

Sun, 02 Aug 2026 12:00:00 GMT

A CodePipeline/CodeBuild pipeline that builds a static site from CodeCommit and deploys it to S3/CloudFront, with an S3 sync Lambda, an async CloudFront invalidation Lambda driven by the CodePipeline continuation-token pattern, and an opt-in manual approval gate.

Budgets & Cost Anomaly Detection

Fri, 31 Jul 2026 12:00:00 GMT

Five FinOps alerting patterns with AWS CDK: threshold-based Budget alerts, ML-based Cost Anomaly Detection, a unified SNS topic with optional Slack delivery, the classic CloudWatch billing alarm, and a scheduled Step Functions cost digest to Slack/Microsoft Teams via AWS Chatbot.

CloudFront with VPC Origin

Sun, 19 Jul 2026 12:00:00 GMT

Configure CloudFront distribution with VPC origin using AWS CDK.

CloudWatch Logs to S3 Archive

Sat, 06 Jun 2026 12:00:00 GMT

Archive CloudWatch Logs to S3 using AWS CDK.

EC2 Advanced Patterns

Sat, 16 May 2026 12:00:00 GMT

Four EC2 deployment patterns using AWS CDK: Single Instance, Auto-Recovery, ASG Always-1, and ASG Multi-AZ with ALB. Covers IMDSv2, SSM Session Manager access, CloudWatch alarms, and operational notifications.

ECS Fargate with ALB

Mon, 20 Apr 2026 12:00:00 GMT

Build a production-ready container application platform combining ECS Fargate and Application Load Balancer (ALB) using AWS CDK.

SQS to Lambda to Kinesis Firehose

Mon, 26 Jan 2026 12:00:00 GMT

Process messages from SQS queue using Lambda function and stream to Kinesis Firehose for data lake storage.

VPC Peering Connection

Wed, 31 Dec 2025 12:00:00 GMT

Establish VPC peering connection between two VPCs for private network communication.

CDK Parameters Best Practices

Thu, 25 Dec 2025 12:00:00 GMT

Learn how to manage parameters and configurations in AWS CDK applications.

VPC with NAT Instance

Wed, 24 Dec 2025 12:00:00 GMT

Create VPC with NAT instance for cost-effective internet access from private subnets.

VPC Basics with CDK

Sun, 21 Dec 2025 12:00:00 GMT

Create a basic VPC infrastructure with public and private subnets using AWS CDK.

IAM Basics with CDK

Tue, 09 Dec 2025 12:00:00 GMT

Create IAM roles, policies, and users with AWS CDK following best practices.

S3 Basics with CDK

Sun, 07 Dec 2025 12:00:00 GMT

Create and configure S3 buckets with various settings using AWS CDK.