Things we learned on someone else's account
Written by the engineers doing the work, usually after a review turned up something we had already seen twice that month.
What we have written down
Short pieces on reviews, migrations and the parts of AWS that bite.
What a Well-Architected review actually finds
Two weeks of reading someone else's AWS account, and the same handful of problems keep showing up: single-AZ databases, IAM nobody has audited since 2021, and instances paid for at on-demand rates for three years.
Writing a cloud roadmap people will actually follow
Most cloud roadmaps are a list of technologies with quarters next to them. A useful one names the constraint you are working against, what you will not do, and who owns each piece.
Making Terraform refuse an untagged resource
AWS Organizations tag policies have been able to describe required tags for years. Since provider 6.22.0, Terraform can fail the plan on them, which is the first time the rule bites before the resource exists.
Your backups are fine. Nobody has tried a restore.
Backup success rate is the metric everyone puts on a dashboard, and it tells you almost nothing. The number that matters is how long ago somebody last restored one into a working environment.
Regional NAT Gateway, and what it removes
One NAT Gateway per Availability Zone was the standard answer for years. The regional variant collapses that to one resource per VPC and takes SNAT port exhaustion off the list of things you monitor.
What 32 AWS account reviews turned up
Across 32 accounts at 11 organisations, 78% had not restored a backup in a year and 61% could not attribute a fifth of their spend to a team. The findings repeat, and they are not the exotic ones.
Who writes these?
The engineers who did the work, named on each post. Nothing here is written by a marketing team or generated and posted without an engineer reading it.
How often do you publish?
When something is worth writing down, which works out at roughly one piece a quarter. We would rather publish four useful notes a year than a post a week that nobody finishes.
Can we reuse something from here?
Quote it with a link back and that is fine. If you want to reprint a whole piece, email [email protected] and we will almost certainly say yes.
Do I have to give an email address to read these?
No. There is no gate, no PDF download form and no newsletter wall. Everything is on the page.
Can you write about our problem?
Send it. If it is something we have seen more than once, it is a good candidate, and we will anonymise anything that identifies you before publishing.
Send us your AWS bill
Thirty minutes with an engineer, no slide deck. We will tell you what we would change first and what it would cost to have us do it.