If you run Amazon OpenSearch Service in production, automated hourly snapshots sound like a good safety net. In reality, they have major operational catches: Backups sit in a hidden, AWS-managed bucket you cannot inspect or download. You cannot export them across accounts or regions for disaster recovery. You cannot retain them past 14 days for […]
Elasticsearch Has 20,000 Shards: What Actually Happens When You Restart a Node? Introduction Restarting an Elasticsearch node sounds simple: That assumption changes when a cluster contains thousands of shards. In one production environment I worked with, the Elasticsearch cluster had approximately 20,000 shards. A node restart could trigger extensive shard recovery, allocation, disk I/O, network […]
Introduction: Static frontends and containerised backends increasingly need to communicate with each other without having the frontends’ S3 buckets or the backends’ services exposed to the public internet. A common configuration is a frontend hosted on S3 and a backend running on ECS behind an Application Load balancer (ALB). When both are locked down — […]
A couple of months ago, I was involved in a Customer 360 initiative that, on paper, looked fairly straightforward.The ask from the business was simple: create a single view of the customer. At first, nobody mentioned graph databases. Nobody talked about nodes, edges, or graph traversals. We were just trying to answer a familiar question:”Can […]
Why a GKE Ingress can look fine in kubectl and still have no IP — and how that differs from EKS and ALB If you have used EKS, HTTP Ingress usually means an Application Load Balancer. Someone installs the AWS Load Balancer Controller, you set ingressClassName: alb, and AWS creates an ALB. Certificates often come […]
How do you redirect thousands of customer subdomains in AWS? Without creating an ALB rule for every customer? A few weeks ago I got handed something that sounded like a non-issue. Redirect a subdomain to a path. One line in the ticket, basically. I assumed I’d knock it out before lunch, and instead spent most […]
Security incidents in AWS rarely stem from zero-day exploits against the hypervisor. In practice, they trace back to routine configuration drift: an IAM policy wildcard added at 2 AM to fix a broken deployment, a database spun up in a public subnet for staging, or a security group rule left open to 0.0.0.0/0. AWS operates […]
Introduction This blog provides step-by-step instructions to implement AWS IAM Identity Center with Microsoft Entra ID as the identity source. Authentication is handled via SAML 2.0. User and group provisioning is handled via SCIM 2.0. IAM Identity Center is administered from a dedicated Identity account using Delegated Administration. Prerequisites AWS Organization active with All Features […]
Introduction As applications move from monoliths to microservices, every new service tends to expose its own API. That sounds fine at first—until each service also has to handle its own authentication, rate limiting, logging, and routing. The result is duplicated logic scattered across every service, and clients that need to know about every backend individually. […]
