Blog category
Autovacuum cannot keep up after Black Friday bulk deletes, and your BRIN index is not helping point lookups. This guide covers vacuum strategy on Aurora, plus Aurora Limitless and DynamoDB hot key mitigation.
Palaniappan PToken buckets allow bursts and leaky buckets smooth traffic. WAF rate rules and API Gateway usage plans implement neither perfectly, but both matter for layered defense.
Palaniappan PA full TLS handshake on every API call adds RTTs your p99 cannot afford. This guide walks through TLS 1.3 1-RTT handshakes and resumption, ACM cert rotation, and security policies on ALB and CloudFront.
Palaniappan PProject Loom virtual threads help I/O-bound Java on ECS, not CPU-bound aggregation. Compare actor models, lock-free queues, and when Lambda concurrency beats pinning threads on EC2.
Palaniappan PControl Tower gets you an org, but it does not tell you how many OUs you need or which policy type owns VPC public access. Since re:Invent 2024 you have four layers (SCP, RCP, declarative, and tag policies), and RCP coverage grew through Feb 2026 (DynamoDB). A composite 60-account enterprise cut exception SCP attachments from 14 ad-hoc to 3 time-boxed RFCs in two quarters by moving accounts out of "temporary" prod OUs.
Palaniappan POn June 10, 2026 AWS made M9g/M9gd on Graviton5 generally available: up to 25% more compute vs M8g, and 35% faster for web and ML per AWS. Field guide to M9g vs M9gd, a canary checklist, RI traps, and agentic-AI fit. The compute-optimized siblings C9g/C9gd went GA June 30.
Palaniappan PYour landing zone set up the org, OUs, and baseline SCPs. Then most teams stall, duplicating resources per account and wiring brittle cross-account role chains. Since re:Invent 2024 the toolkit changed: RCPs bound what can be done TO a resource (even by external principals), declarative policies enforce EC2/VPC/EBS config state that survives new APIs, and one Route 53 Profile can push DNS to up to 5,000 VPCs. This post has the mechanism-by-job decision matrix and a rollout order that avoids lockouts.
Palaniappan PA composite mid-market manufacturer exited a colo of 150 workloads and ~400 TB in 21 months across 8 waves, with 47 minutes of unplanned cutover downtime (industry median per Gartner: ~4 hours per major cutover). The single-wave alternative bid came in at ~$4.8M; the wave-based program ran ~$2.1M. The post covers how the wave plan, dependency cutoff, and rollback layer fit together against a hard landlord deadline.
Palaniappan PJuly 2026: EU Data Act switching charges hit zero by 12 Jan 2027; AWS free DTO-on-exit still requires Support approval and typically a 90-day move window. Exit cost is re-platform time (~$113k in our model), not the ~$4,400 egress line.
Palaniappan PA stack of ALB + EC2 + RDS Multi-AZ + S3 composes to ~99.83% availability, so promising customers 99.9% is a check you cannot cash. This guide does the composition math, converts it to an error budget (99.9% = 43.2 min/month), and shows why AWS service credits never fund your SLA penalties.
Palaniappan PJuly 2026: Barclays ~86% plan some repatriation; IDC ~8 to 9% full exit, and both are true. Per-workload placement beats multi-cloud-by-default. Includes a scored matrix and the daily tax of “just in case” portability.
Palaniappan PA CCoE that only publishes standards decks fails within two quarters. This 2026 operating model ties platform RFCs, delegated-admin guardrails, Well-Architected reviews, and FinOps chargeback, benchmarked on a 14-account estate that cut deploy exceptions from 23/month to 6 in 90 days.
Palaniappan P
