Skip to main content

Tagged

aws

Tagged articles
273
AWS Incident Response Runbooks (2026): What Changes Now That Security Incident Response Is Metered and GuardDuty Correlates Attack Sequences
Security & Compliance
6 min

AWS Incident Response Runbooks (2026): What Changes Now That Security Incident Response Is Metered and GuardDuty Correlates Attack Sequences

Two 2025 shifts rewrite the IR playbook: GuardDuty Extended Threat Detection now emits a single critical attack-sequence finding instead of a pile of high findings, and AWS Security Incident Response moved to metered pricing (free first 10,000 findings/month, then $0.000676 each) on November 21, 2025. The lesson is to page humans on the top 1% of correlated criticals, isolate instead of terminate, and let auto-triage absorb the rest.

Nash Ogden
AWS KMS Encryption Architecture (2026): The Per-Tenant CMK Trap, the 10,000 req/s Shared Quota, and When AWS-Owned Keys Win
Security & Compliance
7 min

AWS KMS Encryption Architecture (2026): The Per-Tenant CMK Trap, the 10,000 req/s Shared Quota, and When AWS-Owned Keys Win

Most KMS guides stop at "enable encryption." The architecture decision that actually bites is the key boundary: split one CMK into 3,200 per-tenant keys and you pay ~$3,200/mo in key storage alone while still sharing a single 10,000 req/s symmetric quota. The post covers the decision matrix, the throttle math, and the encryption-context pattern that gives per-tenant isolation without per-tenant keys.

Nash Ogden
AWS Tagging, Chargeback, and FinOps Ownership (2026): Tag Policy vs SCP, the Untaggable 21%, and Splitting Shared Cost Without a Spreadsheet War
Cost Optimization & FinOps
6 min

AWS Tagging, Chargeback, and FinOps Ownership (2026): Tag Policy vs SCP, the Untaggable 21%, and Splitting Shared Cost Without a Spreadsheet War

Tag policies report; only an SCP prevents untagged spend. And ~21% of a typical bill (egress, inter-AZ transfer, Enterprise Support, shared platform services) carries no tag any tool can read. The post covers the two-layer enforcement model, the Cost Categories split-charge rules that replace the monthly allocation spreadsheet, and why you show back before you charge back.

Kevin W.
Reserved Instances vs Savings Plans on AWS (2026): The Three-Way Choice, the 22-Month Break-Even, and When to Skip Commitment Entirely
Cost Optimization & FinOps
8 min

Reserved Instances vs Savings Plans on AWS (2026): The Three-Way Choice, the 22-Month Break-Even, and When to Skip Commitment Entirely

Most "RI vs Savings Plan" content treats them as peers. In mid-2026 they are not. A 3-year All-Upfront Compute Savings Plan saves a composite ~$60k/mo SaaS roughly $864k over 3 years vs a 1-year No-Upfront plan, but breaks even at ~22 months and locks instance-family flexibility. Buy the wrong commitment and a Graviton migration strands the discount. This post gives the decision tree we use.

Kevin W.
Data Center Exit on AWS (2026): Wave Design, the 22-Month Program, and Why Big-Bang Cutovers Fail on People Before Tech
Cloud Architecture
8 min

Data Center Exit on AWS (2026): Wave Design, the 22-Month Program, and Why Big-Bang Cutovers Fail on People Before Tech

A composite mid-market manufacturer exited a colo of 150 workloads and ~400 TB in 21 months across 8 waves, with 47 minutes of unplanned cutover downtime (industry median per Gartner: ~4 hours per major cutover). The single-wave alternative bid came in at ~$4.8M; the wave-based program ran ~$2.1M. The post covers how the wave plan, dependency cutoff, and rollback layer fit together against a hard landlord deadline.

Palaniappan P

Newer posts

Older posts