Blog category
Token buckets allow bursts; leaky buckets smooth traffic—WAF rate rules and API Gateway usage plans implement neither perfectly but both matter for layered defense.
A full TLS handshake on every API call adds RTTs your p99 cannot afford. This guide walks TLS 1.3 1-RTT resumption, ACM cert rotation, and security policies on ALB and CloudFront.
Project Loom virtual threads help I/O-bound Java on ECS—not CPU-bound aggregation. Compare actor models, lock-free queues, and when Lambda concurrency beats pinning threads on EC2.
Control Tower gets you an org; it does not tell you how many OUs you need or which policy type owns VPC public access. Since re:Invent 2024 you have four layers — SCP, RCP, declarative, and tag policies — and RCP coverage grew through Feb 2026 (DynamoDB). A composite 60-account enterprise cut exception SCP attachments from 14 ad-hoc to 3 time-boxed RFCs in two quarters by moving accounts out of "temporary" prod OUs.
On June 10, 2026 AWS GA’d M9g/M9gd on Graviton5 — up to 25% more compute vs M8g, 35% faster for web and ML per AWS. Field guide: M9g vs M9gd, canary checklist, RI traps, and agentic-AI fit. Compute-optimized sibling C9g/C9gd GA June 30.
Your landing zone set up the org, OUs, and baseline SCPs — then most teams stall, duplicating resources per account and wiring brittle cross-account role chains. Since re:Invent 2024 the toolkit changed: RCPs bound what can be done TO a resource (even by external principals), declarative policies enforce EC2/VPC/EBS config state that survives new APIs, and one Route 53 Profile can push DNS to up to 5,000 VPCs. Here is the mechanism-by-job decision matrix and a rollout order that avoids lockouts.
A composite mid-market manufacturer exited a colo of 150 workloads and ~400 TB in 21 months across 8 waves, with 47 minutes of unplanned cutover downtime (industry median per Gartner: ~4 hours per major cutover). The single-wave alternative bid came in at ~$4.8M; the wave-based program ran ~$2.1M. Here is how the wave plan, dependency cutoff, and rollback layer fit together against a hard landlord deadline.
July 2026: EU Data Act switching charges hit zero by 12 Jan 2027; AWS free DTO-on-exit still requires Support approval and typically a 90-day move window. Exit cost is re-platform time (~$113k in our model), not the ~$4,400 egress line.
A stack of ALB + EC2 + RDS Multi-AZ + S3 composes to ~99.83% availability—so promising customers 99.9% is a check you cannot cash. This guide does the composition math, converts it to an error budget (99.9% = 43.2 min/month), and shows why AWS service credits never fund your SLA penalties.
July 2026: Barclays ~86% plan some repatriation; IDC ~8–9% full exit — both true. Per-workload placement beats multi-cloud-by-default. Scored matrix + daily tax of “just in case” portability.
A CCoE that only publishes standards decks fails within two quarters. This 2026 operating model ties platform RFCs, delegated-admin guardrails, Well-Architected reviews, and FinOps chargeback—benchmarked on a 14-account estate that cut deploy exceptions from 23/month to 6 in 90 days.
July 2026: MAP Mobilize should not start with more than five failed Platform/Security controls. 47-point readiness checklist (People, Platform, Security, FinOps) for Assess gates — CAF 3.0 + Migration Lens, post–Migration Hub.