Sandro Volpicella

Is there anything worse than onboarding a new dev with an outdated diagram? You spend 20 minutes explaining "oh ignore that box, we deleted that last year". It is confusing and inefficient. We found a better way using Kiro. It scans your live AWS environment.

I refuse to spend another Friday afternoon in Drawio. Documentation is important. But manual documentation is painful. We have been experimenting with MCP servers and AI to solve this. The tool connects directly to your infrastructure. It reads your Terraform or CDK.

I've been running centralized logging for our AWS accounts. CloudWatch log centralization has two gotchas that caught me off guard. Gotcha #1: Settings Don't Transfer 🚨 Log Group settings get stripped during the copy. Retention policies? Gone. Data protection policies? Gone.

Gotcha #2: Hard to Know Which Account Logs Come From 🤔 Log Group names don't show source accounts. You can't tell which logs came from where in the console. Solution: Use the @aws.account and @aws.region fields in Logs Insights. These fields are indexed, so no extra query costs.

I've been running centralized logging for our AWS accounts. CloudWatch log centralization has two gotchas that caught me off guard. Gotcha #1: Settings Don't Transfer 🚨 Log Group settings get stripped during the copy. Retention policies? Gone. Data protection policies? Gone.

Your architecture diagram is lying to you. It was probably correct on day one. But then you added a Lambda function. Changed a DynamoDB index. And forgot to update the doc. We all do this. That is why we started using AI to fix it.

Supply chain attacks are rising. And your `node_modules` folder is the perfect target. OWASP dropped their Top 10 for NPM security. It's a wake-up call for many of us. I summarized the key points you need to know. 𝟏. 𝐃𝐨𝐧'𝐭 𝐭𝐫𝐮𝐬𝐭 𝐬𝐜𝐫𝐢𝐩𝐭𝐬

𝟓. 𝐀𝐮𝐝𝐢𝐭 𝐲𝐨𝐮𝐫 𝐝𝐞𝐩𝐬 `npm audit` is free. Run it in your CI. Fail the build if there are critical issues. 𝟔. 𝐔𝐬𝐞 𝐚 𝐩𝐫𝐨𝐱𝐲 Tools like Verdaccio let you cache and scan packages before they hit your developer's machines.

Supply chain attacks are rising. And your `node_modules` folder is the perfect target. OWASP dropped their Top 10 for NPM security. It's a wake-up call for many of us. I summarized the key points you need to know. 𝟏. 𝐃𝐨𝐧'𝐭 𝐭𝐫𝐮𝐬𝐭 𝐬𝐜𝐫𝐢𝐩𝐭𝐬

`npm install` runs scripts by default. This is how malware gets in. Use `--ignore-scripts` to be safe. 𝟐. 𝐋𝐨𝐜𝐤𝐟𝐢𝐥𝐞𝐬 𝐚𝐫𝐞 𝐦𝐚𝐧𝐝𝐚𝐭𝐨𝐫𝐲 If you don't use `npm ci`, you are installing different versions than your team. That breaks things. And it opens security holes.

Stop dragging boxes around in Drawio. Seriously. It is 2026. We should have 𝐚𝐮𝐭𝐨𝐦𝐚𝐭𝐞𝐝 this years ago. We recorded a video showing how to use AI to generate your AWS diagrams. It pulls data right from your 𝐥𝐢𝐯𝐞 𝐞𝐧𝐯𝐢𝐫𝐨𝐧𝐦𝐞𝐧𝐭.

Stop using 𝐒𝟑 𝐒𝐭𝐚𝐧𝐝𝐚𝐫𝐝 as your default storage class. Unless you know exactly how your data will be accessed, you are likely overpaying. I used to default to Standard for everything. Then I looked at our bill.

It is available instantly. No retrieval fees. No restoration time. You literally get the savings of Glacier with the experience of S3 Standard. ⚠️ 𝐓𝐡𝐞 𝐨𝐧𝐥𝐲 𝐜𝐚𝐯𝐞𝐚𝐭𝐬: 1. Files smaller than 128KB don't get moved (but you still pay the monitoring fee).

Stop using 𝐒𝟑 𝐒𝐭𝐚𝐧𝐝𝐚𝐫𝐝 as your default storage class. Unless you know exactly how your data will be accessed, you are likely overpaying. I used to default to Standard for everything. Then I looked at our bill.

We were paying for instant access to logs and backups that no one had touched in a year. Now, I use 𝐒𝟑 𝐈𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐭-𝐓𝐢𝐞𝐫𝐢𝐧𝐠 for almost everything. The concept is simple: AWS monitors the objects for you.

Everyone tells you to move old data to Glacier to save money. But they usually forget to mention the pain. • Retrieval fees hurt. • Waiting 5-12 hours for data sucks. That is why I prefer 𝐒𝟑 𝐈𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐭-𝐓𝐢𝐞𝐫𝐢𝐧𝐠. It solves the biggest problem with archiving:

If you suddenly need to read that file? It opens instantly. And you pay 𝐙𝐞𝐫𝐨 retrieval fees. This is the killer feature. With standard Glacier, reading your own backup is a hassle. With Intelligent Tiering, you don't even notice it happened. The only time I don't use it?

Everyone tells you to move old data to Glacier to save money. But they usually forget to mention the pain. • Retrieval fees hurt. • Waiting 5-12 hours for data sucks. That is why I prefer 𝐒𝟑 𝐈𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐭-𝐓𝐢𝐞𝐫𝐢𝐧𝐠. It solves the biggest problem with archiving:

We pull in thousands of dependencies. We trust them blindly. That is a mistake. 💣 OWASP just released their top 10 security practices for NPM. I went through them so you don't have to. Here is what you need to change in your workflow:

8. 𝐓𝐮𝐫𝐧 𝐨𝐧 𝟐𝐅𝐀. This should be non-negotiable for every maintainer. 9. 𝐔𝐬𝐞 𝐠𝐫𝐚𝐧𝐮𝐥𝐚𝐫 𝐭𝐨𝐤𝐞𝐧𝐬. Don't use your personal token for CI/CD. Use automation tokens. 10. 𝐖𝐚𝐭𝐜𝐡 𝐨𝐮𝐭 𝐟𝐨𝐫 𝐭𝐲𝐩𝐨𝐬. `react` is not `rceact`. Typosquatting is real.

We pull in thousands of dependencies. We trust them blindly. That is a mistake. 💣 OWASP just released their top 10 security practices for NPM. I went through them so you don't have to. Here is what you need to change in your workflow:

4. 𝐂𝐡𝐞𝐜𝐤 𝐲𝐨𝐮𝐫 𝐩𝐫𝐨𝐣𝐞𝐜𝐭 𝐡𝐞𝐚𝐥𝐭𝐡. `npm outdated` and `npm doctor` are built-in tools. Use them. 5. 𝐒𝐜𝐚𝐧 𝐟𝐨𝐫 𝐯𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐢𝐞𝐬. Make `npm audit` part of your CI pipeline.

We pull in thousands of dependencies. We trust them blindly. That is a mistake. 💣 OWASP just released their top 10 security practices for NPM. I went through them so you don't have to. Here is what you need to change in your workflow:

1. 𝐒𝐭𝐨𝐩 𝐩𝐮𝐛𝐥𝐢𝐬𝐡𝐢𝐧𝐠 𝐬𝐞𝐜𝐫𝐞𝐭𝐬. It happens faster than you think. Use `.npmignore` and always dry-run before publishing.

Sometimes you need to give frontend developers the ability to choose their own data. And if you want to build that in a serverless way you need to use AppSync! We have all been there. The frontend asks for one more field. The backend team puts it on the backlog.

You can cache specific fields or full queries. No need to spin up a separate Redis instance. 🔐 𝐅𝐢𝐧𝐞-𝐆𝐫𝐚𝐢𝐧𝐞𝐝 𝐀𝐜𝐜𝐞𝐬𝐬 Control who sees what. You can use @auth directives to lock down specific fields based on user groups. 📱 𝐎𝐟𝐟𝐥𝐢𝐧𝐞 𝐒𝐮𝐩𝐩𝐨𝐫𝐭

Sometimes you need to give frontend developers the ability to choose their own data. And if you want to build that in a serverless way you need to use AppSync! We have all been there. The frontend asks for one more field. The backend team puts it on the backlog.

My current claude-code workflow: 1. cc (alias for alias cc='claude --dangerously-skip-permissions') 2. /spec <idea of the feature> - give all context needed, interviews me with all important things, lots of depth. 3. Specfile is created in Markdown (not JSON/YML -> MD)

Sometimes claude jumps back into plan mode after the /clear if it sees it is a huge feature. I'll let it do it and then verify it.

My current claude-code workflow: 1. cc (alias for alias cc='claude --dangerously-skip-permissions') 2. /spec <idea of the feature> - give all context needed, interviews me with all important things, lots of depth. 3. Specfile is created in Markdown (not JSON/YML -> MD)

One nugget I really took from the podcast of Steinberger & Friedman is this prompt: With everything you have seen right now, is there anything to improve. In the image is the exact prompt I'm using and I really like the results.

It just makes the work with an agent more natural like I would work with a colleague as well. e.g.: "hey I implemented the /me api but saw that we are mixing business logic from the API package which should be in the core package, should I refactor that?"