Guides
Building on AWS.
A platform engineering series for startups: thirteen long-form guides for the small team that owns the whole estate.
Long-form guides for senior DevOps, SRE and platform engineers at startups on AWS — especially crypto and web3 infrastructure companies, where a small team runs signing keys, hot wallets, relayers, RPC fan-out and indexers, and a single mistake can move funds.
Each guide covers the same ground: the forces at play, an opinionated reference design with working configuration, the tradeoffs behind every decision and the signals that say it is time to revisit it, anonymised field lessons from production incidents and review findings, a prioritised checklist, and references to primary sources.
They are written to be read in order, but each one stands alone. Nothing here names a client, an employer or a person.
-
0140 min
AWS Account Strategy and Network Topology for Startups
Single account vs Organizations, CIDR planning, PrivateLink vs peering vs TGW, VPN / SSM / bastion access
-
0237 min
Terraform State and Module Design
Root decomposition, remote-state coupling, secrets in state, module versioning, env parity
-
0341 min
Infrastructure CI/CD and Change Gates That Actually Hold
GitHub OIDC, plan vs apply roles, guardrail Denies, approval gates, drift detection
-
0435 min
GitOps and Progressive Delivery on EKS with Argo CD and Argo Rollouts
Argo CD hub, sync policy and waves, promotion PRs, Argo Rollouts, automatic rollback
-
0535 min
Hardened-by-Default Kubernetes Workloads: Library Charts, Pod Security Admission, NetworkPolicy and Policy-as-Code
Secure-by-default Helm library, PSA, NetworkPolicy, rendered-manifest policy-as-code
-
0639 min
Container Supply-Chain Security on AWS: From Build to Admission
Multi-arch builds, ECR, push-role scoping, scanning, signing, SLSA, admission control
-
0739 min
Secrets, Identity and Signing Keys for Blockchain Startups on AWS
KMS transaction signers, key policies, TEEs, secret stores, human IAM and MFA
-
0841 min
Self-Hosted Observability on EKS: Grafana, Loki, Tempo, VictoriaMetrics and OpenTelemetry
Grafana / Loki / Tempo / VictoriaMetrics / OTel on EKS, cardinality, auth
-
0940 min
Alerting, SLOs and Paging That Engineers Trust
Burn-rate SLOs, runbook linking, NoData semantics, watchdogs, on-chain alerts
-
1045 min
Disaster Recovery and Backups for Startups on AWS: Inventory, Tiers, Restore Checks and Break-Glass
Inventory and tiers, restore verification, break-glass playbooks, drills
-
1133 min
EKS Compute, Capacity Planning and Cost for Startups
Karpenter, Graviton, HPA vs connection budgets, Savings Plans, provider quotas
-
1238 min
The Edge and the Data Tier: Load Balancers, DNS, Certificates, Postgres, Redis, RabbitMQ and RPC Proxies
NLB / Traefik / ALB, DNSSEC / CAA, RDS + Proxy, Valkey, RabbitMQ, RPC proxying
-
1342 min
Incident Response and Operational Documentation as Code
Incident roles, post-mortems, runbooks linked from alerts, docs-drift CI