Thinking
Technical articles on AI, development tools, cloud architecture, and software engineering.
AWS NAT Gateway cost: the most expensive line you don't see
How much does an AWS NAT Gateway cost per month? $32.85 per gateway before any traffic, plus $0.045/GB. Worked examples, our $102 bill and five ways to cut it.
Reserved, Savings Plans, or nothing: when a one-year commitment is actually worth it at small scale
AWS will give you up to 72 % off compute if you promise to keep paying for it for three years. The number is real and it's in every cost-optimisation checklist.
Secrets in CDK: Secrets Manager, Parameter Store, and never anything in the template
A CloudFormation template is a text file. It's stored by CloudFormation, it's in cdk.out on every developer's disk, it's in the CI logs from the last synth…
WAF for a Next.js app: the managed rules that block legitimate traffic, and what we did about them
Turning on AWS WAF in front of a web application is one CDK construct and a checkbox's worth of managed rule groups.
Rotating the database password without downtime: the thing you've been putting off
Everyone agrees the database password should rotate. Almost nobody's does, and the reason isn't laziness.
An incident runbook for a team without on-call
Big companies have on-call rotations, incident commanders, severity matrices and a tooling budget to match.
Backups you've never restored aren't backups. A restore drill, timed.
Every AWS data store has backups turned on by default or by a checkbox. Aurora keeps automated backups. DynamoDB has point-in-time recovery. S3 has versioning.
Health checks that lie: six ways your service says "ready" when it isn't
A health check is a contract between your application and the thing that routes traffic to it.
Rate limiting: at the edge, in the gateway, or in the app? Three layers, three jobs
"Add rate limiting" is a one-line ticket that hides three different problems.
A monorepo with three apps: how we build only what changed, and got the pipeline from eight minutes to three
Three Next.js applications, four shared packages, one repository. That's the shape of the platform we run for a US client, and it's the right shape: shared…
Docker images for Node in 2026: multi-stage, distroless, and the 1.1 GB image that became 140 MB
How a multi-stage, distroless Dockerfile took our Node/Next.js image from 1.1 GB to 140 MB: the full Dockerfile, what broke, and the before/after numbers.
DynamoDB single-table or Postgres? How we chose, per workload, and where we got it wrong
The DynamoDB versus Postgres debate is usually argued as a religion. One side says relational data belongs in a relational database and single-table design is…
Queues without Kafka: SQS, EventBridge, and the one place we actually needed a stream
Every platform reaches the moment where a request does too much. The checkout handler sends an email, updates the search index, notifies the warehouse, records…
What Claude Code wrote of our infrastructure, and what we refused to merge
We use Claude Code for infrastructure work daily, on a platform we run for a US client: CDK stacks, deploy scripts, IAM policies, alarms, runbooks.
Infrastructure as code does not mean Terraform. CDK, Pulumi, and the question that actually decides it
Somewhere around 2019, "infrastructure as code" became a synonym for Terraform in most conversations, the way "search" means Google. It is a reasonable default.
Your logs shouldn't know which cloud they run in
It's 02:40 and the order pipeline is dropping events. The API runs on EKS.
How much AWS costs a small startup: our bill, line by line
How much does AWS cost for a small startup? Our real bill: ~$750 a month for three environments, line by line, and the NAT, logs and secrets nobody budgets.
Three AWS accounts, one CDK codebase: how we keep dev, staging and prod from contaminating each other
Most of the AWS articles on this blog so far have been guides: what a service does, how to set it up, what it costs. This one is different.
The day CloudFormation deleted our App Runner services: a post-mortem and the four safety nets we added
On 30 April 2026, a single cdk deploy run from a laptop deleted every App Runner service in our dev environment.
AWS App Runner after six months in production: an honest review
An honest AWS App Runner review after six months running three Next.js apps in production: what works, the 120-second timeout, the pipeline and the cost.
Fable 5.1 vs Fable 5: same price, different bill
Anthropic released Claude Fable 5.1 and the first thing you see on the pricing page is that nothing has changed: $10 per million input tokens, $50 per million…
Don't Build an Agent. Build the Agent Factory.
Anyone can build an AI agent in a weekend. A good model, a few tools, a decent system prompt — and you have a demo that impresses in Monday's meeting.
"How many years of experience do you have with a library released last year?"
Or: how the recruiting industry manages to reject exactly the people it's looking for. This week I got a message from a UK recruitment agency.
Why does AI keep "escaping"? What actually happens when a model hacks a system on its own
Over the past few weeks the press has been full of dramatic headlines: AI models that "escaped" the lab and hacked real companies.