Writing
Thirteen guides for the small team that owns the whole AWS estate
A 13-part series on running AWS infrastructure with one or two platform engineers: accounts and networking, Terraform, CI/CD gates, GitOps, Kubernetes hardening, supply chain, signing keys, observability, alerting, disaster recovery, cost, the edge and the data tier, and incident response.
Most infrastructure writing assumes a platform team. A startup has one or two people, a fund-moving production environment, and no slack to get the irreversible decisions wrong.
I’ve collected thirteen long-form guides on that estate — nine hours of reading, and a lot of copied configuration — and published them as a series. Each one has the same shape: the forces at play, an opinionated reference design with working configuration, the tradeoffs behind each decision, the signals that say it is time to revisit it, anonymised field lessons from production incidents and review findings, a prioritised checklist, and references to primary sources.
- 01 · AWS account strategy and network topology — single account vs Organizations, CIDR planning, PrivateLink vs peering vs TGW, VPN / SSM / bastion access
- 02 · Terraform state and module design — root decomposition, remote-state coupling, secrets in state, module versioning, environment parity
- 03 · Infrastructure CI/CD and change gates — GitHub OIDC, plan vs apply roles, guardrail Denies, approval gates, drift detection
- 04 · GitOps and progressive delivery — an Argo CD hub, sync policy and waves, promotion PRs, Argo Rollouts, automatic rollback
- 05 · Kubernetes workload hardening — a secure-by-default Helm library, Pod Security Admission, NetworkPolicy, rendered-manifest policy-as-code
- 06 · Software supply-chain security — multi-arch builds, ECR, push-role scoping, scanning, signing by digest, SLSA, admission control
- 07 · Secrets, identity and signing keys — KMS transaction signers, key policies, TEEs, secret stores, human IAM and MFA
- 08 · Self-hosted observability — Grafana, Loki, Tempo, VictoriaMetrics and OpenTelemetry on EKS, cardinality, auth
- 09 · Alerting, SLOs and paging — burn-rate SLOs, runbook linking, NoData semantics, watchdogs, on-chain alerts
- 10 · Disaster recovery and backups — asset inventory and tiers, restore verification, break-glass playbooks, drills
- 11 · EKS compute, capacity and cost — Karpenter, Graviton, HPA vs connection budgets, Savings Plans, provider quotas
- 12 · The edge and the data tier — NLB / Traefik / ALB, DNSSEC and CAA, RDS with Proxy, Valkey, RabbitMQ, RPC proxying
- 13 · Incident response and docs as code — incident roles, post-mortems, runbooks linked from alerts, documentation-drift CI
The series index is at /guides/, and each guide links back to it. The guides carry no dates and there is no feed for them: they are a reference that gets updated in place, not a stream.
A note on provenance: every field lesson in the series is generalised. No client, employer or colleague is named anywhere in the thirteen guides, and the configuration is written to be copied rather than adapted from something that only makes sense inside one company.