#aws

PII masking with Glue DataBrew — the rubric we ended up with

“A rubric that survives contact with auditors is a rubric. Everything else is a draft.”

Agent-based DevOps with Q Developer — kept vs tossed

“An agent that's wrong 5% of the time is not a 5% problem. It's a trust problem with a percentage attached.”

Open-sourcing the PII Masking Starter Kit

“Get the rubric right, the rest is bookkeeping.”

Defense in depth for a connected-product fleet

“A single layer of security is hope. Seven layers, each cheap and known to its owner, is a posture.”

Strands + AgentCore — a year-end agent-stack inventory

“Pick the framework that matches your team's experience, not the one with the loudest blog posts.”

Field-grade device identity at fleet scale

“If you can't revoke a single device in under a minute, you don't have device identity. You have hope.”

Open-sourcing the Connected Products Starter Kit

“The first 30 days of a connected-product team are mostly the same six pitfalls. Open-source what doesn't need to be re-discovered.”

Bedrock AgentCore at Summit NY — what it actually changes

“AgentCore is what Bedrock Agents should have been from the start. That doesn't make it the wrong answer now.”

OTA firmware updates without bricking the fleet

“Bricking a device in the field is a quarter you don't get back.”

The AWS spend audit I do every quarter

“AWS doesn't optimize your bill. AWS optimizes their revenue. The two are not the same hobby.”

Knowledge Bases for Bedrock in production — the gotchas list

“Managed RAG is 80% of the work. The other 20% is most of the production headaches.”

Three things from re:Invent that actually change my roadmap

“AWS announces two hundred things. You change your roadmap based on three.”

What good IoT observability looks like in CloudWatch

“An IoT product without per-device-percentile latency dashboards is a product that doesn't know it's broken.”

Bedrock Agents, half a year in — the parts I actually use

“Agents are router code with model-shaped opinions. Useful, but not magic — and that's exactly why I kept some of it.”

SageMaker Pipelines — week three notes

“MLOps is just DevOps with a worse vocabulary.”

DynamoDB for time-series IoT — when the relational urge is wrong

“A Postgres query that does a sequential scan on six months of telemetry is a Friday-afternoon meeting waiting to happen.”

Lambda vs Fargate vs ECS — the napkin decision tree

“Cold-start tolerance is the question; everything else is a follow-up.”

First week with Bedrock: a PM's read on the September GA

“Bedrock isn't a model — it's the absence of a vendor lock-in argument.”

Building a connected hardware product — month one

“The hardware decision is a five-year contract with your past self. On v1 I argued for two more bytes and lost. This time the room is mine.”