Tobias Schmidt

Terraform is still my favorite IaC tool. And this is the repo I keep coming back to: the Awesome Terraform list, the largest curated collection of Terraform resources out there. Modules, providers, linters, testing tools, configuration examples, books. Hand-picked.

A leaked access key used to mean someone spun up GPU instances on your buckets. Now the expensive thing is quieter: tokenmaxxing through Bedrock 😬 The case that stuck with me: $97,000 in 48 hours, around 2 million Bedrock tokens per minute, one long-lived key.

Debugging inside a private VPC usually ends with a bastion host and a security group rule you promise to remove later. There is a mode most people never toggle: CloudShell VPC mode.

Your session runs in the subnet. It picks up the security groups and network ACLs around it, so the things that have no route from the internet just answer. • Private EC2 instances • RDS databases with no public endpoint • Internal load balancers

S3 traffic from a private subnet still leaves through the internet by default. And AWS bills you for the privilege 💸 That is the bit that gets me. A Gateway Endpoint fixes it, costs nothing, and is not enabled by default. For years now. Why not?

Every gigabyte your instances pull from S3 goes out to a NAT Gateway, gets processed, and comes back in. Gateway Endpoints keep that traffic inside the VPC and skip the metering entirely. Yet neither S3 nor DynamoDB gets one out of the box. Not in a fresh account. Not in the console wizard.

Someone googled "AWS Login" and the top sponsored result was a fake. A clone of the AWS console login page Didn't have this on my radar either, so just a thing to look out for 😬

Not just AWS. The same thread has a fake Homebrew page in the ads that installed a root-level package, and someone else has seen the trick in YouTube pre-rolls. What actually protects you: • Bookmark the console URL and never search for it • Use the Access Portal for sign-in

Someone googled "AWS Login" and the top sponsored result was a fake. A clone of the AWS console login page Didn't have this on my radar either, so just a thing to look out for 😬

The slowness you blame on CDK has always been CloudFormation. And CloudFormation just got up to 2x faster It's automatic as of October 1. Your cdk deploy doesn't change, there's no flag to pass.

Caveat from AWS: the gain varies by resource. Smaller on things that take long to stabilize, like database instances and load balancers. There's also Express mode if you want more. That one is opt-in: cdk deploy --express skips the extended stabilization checks and claims up to 4x. Link

The slowness you blame on CDK has always been CloudFormation. And CloudFormation just got up to 2x faster It's automatic as of October 1. Your cdk deploy doesn't change, there's no flag to pass.

Every CDK deploy runs through CloudFormation, so CDK just inherits it. The slow part was never the CDK synth. The biggest wins are on the resources you touch constantly. IAM policies, security groups and VPC route tables now finish in seconds.

TIL Security Hub monitors Azure resources now. It shipped in July and I completely missed it 😅

CSPM posture checks and Inspector vulnerability management are separate integrations, so you set up only the part you want. You can create the integration from every Region that has Security Hub, except Middle East (UAE), Middle East (Bahrain), and the Taipei and New Zealand Regions.

TIL Security Hub monitors Azure resources now. It shipped in July and I completely missed it 😅

It auto-discovers your Azure VMs, container images in ACR, Function Apps and identities, then checks them for misconfigurations, internet exposure and software vulnerabilities. Posture checks run against the CIS Microsoft Azure Foundations Benchmark. What you get:

PrivateLink has a new endpoint type: tunnel endpoints. You can now share a whole CIDR range instead of one resource at a time! 💪 With a vendor, that used to mean one Resource Configuration per resource => Ten services / ten configs to keep in sync.

Now a single Resource Configuration can describe a whole CIDR range in your network. Share it through RAM, the other side creates a tunnel endpoint, and everything inside that range is reachable! So PrivateLink moves from share-this-one-service to share-this-piece-of-my-network!

I'm already a fan of the AWS DevOps Agent. AWS just shipped its Well-Architected sibling in preview It's the next-gen take on Trusted Advisor and the Well-Architected Tool 🛠 What it actually does:

Two catches. It runs through AWS Support, so you need a Support plan. And the agent is only in us-east-1, us-east-2 and us-west-2, though you can onboard workloads from any commercial Region. Link to the announcement aws.amazon.com/about-aws/w...

I'm already a fan of the AWS DevOps Agent. AWS just shipped its Well-Architected sibling in preview It's the next-gen take on Trusted Advisor and the Well-Architected Tool 🛠 What it actually does:

• Reviews cost, security, performance and reliability, then ranks the fixes by impact and effort • Reads your Terraform, CDK and CloudFormation, and hands back the code change it wants • Doesn't stop at the finding: SSM runbook, CLI scripts or a console walkthrough to actually do it

AWS rebuilt the front end of CloudWatch. The new one is called Omni, and it's GA now. The idea is simple. Your logs and metrics are already in CloudWatch. They're just spread over accounts, regions and sometimes other clouds. Omni is one place to look at all of it.

Two things before you plan around it. Three regions so far (us-east-1, us-west-2, eu-west-1). No published pricing. Link to the announcement aws.amazon.com/about-aws/w...

AWS rebuilt the front end of CloudWatch. The new one is called Omni, and it's GA now. The idea is simple. Your logs and metrics are already in CloudWatch. They're just spread over accounts, regions and sometimes other clouds. Omni is one place to look at all of it.

You can also ask a plain-language question instead of clicking through dashboards. It pulls the relevant telemetry, builds a view around it, and works toward root cause with the DevOps Agent.

AWS rebuilt the front end of CloudWatch. The new one is called Omni, and it's GA now. The idea is simple. Your logs and metrics are already in CloudWatch. They're just spread over accounts, regions and sometimes other clouds. Omni is one place to look at all of it.

AWS is getting back into expanding core services instead of just releasing GenAI stuff. EventBridge just got one bus for the whole org Before this it was one bus per account, meaning 1. Cross-account policies 2. bus-to-bus forwarding and

Existing buses are untouched (they just show up as classic in the console now) Link to the announcement aws.amazon.com/blogs/aws/i...

AWS is getting back into expanding core services instead of just releasing GenAI stuff. EventBridge just got one bus for the whole org Before this it was one bus per account, meaning 1. Cross-account policies 2. bus-to-bus forwarding and

3. nagging dedup that needs to be taken care by yourself. What you get now: • One bus across every account in the org, wired through RAM • Filter, targets, retries and DLQ in one subscriber object • EventGroupId for ordered delivery, opt in per subscriber

workshops.aws is still the most underused thing AWS gives away for free I keep sending people there and most have never opened it.

catalog.workshops.aws/eks-auto-mo...

workshops.aws is still the most underused thing AWS gives away for free I keep sending people there and most have never opened it.

Auto Mode is AWS running the cluster plumbing for you. Compute provisioning, autoscaling, networking, storage and security come pre-installed and managed, built on the same Karpenter ideas underneath.

workshops.aws is still the most underused thing AWS gives away for free I keep sending people there and most have never opened it.