Loading…
AWS
Cloud computing platform providing infrastructure, storage, databases, networking, AI, analytics, security, and application services.
- 50 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
Building cloud-native PACS on AWS
Multi-hospital networks face rising imaging volumes, siloed on-premises PACS, radiologist routing bottlenecks, and storage that must expand for 7 to 10 years of retention. The proposed pattern uses a hub-and-spoke hybrid architecture: local PACS instances preserve LAN-speed reading, while a centralized AWS archive provides cross-facility discovery, disaster recovery, and lifecycle-managed storage. Modalities send DICOM through C-STORE to local VNA servers, which normalize and compress objects; asynchronous replication sends images to Amazon S3, while Amazon Aurora PostgreSQL stores metadata and routing information. The AWS deployment spans two Availability Zones, places PACS services behind Network Load Balancers, and includes CloudFront and AWS WAF. Storage guidance distinguishes S3 Intelligent-Tiering, Glacier Instant Retrieval, and Glacier Deep Archive according to access frequency and retention needs.
How DHI Group accelerates generative AI workloads from idea to production using hackathons
DHI Group needed to move generative AI efforts beyond proofs of concept because its traditional software development lifecycle took months, while it sought faster delivery, technical validation, and broader AI literacy. AWS and DHI used a four-phase Hackathon Acceleration Package—preparation, enablement, a three-day build event, and a path to production—with workshops on Amazon Bedrock AgentCore, AI-DLC, and Kiro. Twenty participants formed three teams and produced prototypes for employer analytics, intelligent candidate matching, and a unified ClearanceJobs–AgileATS marketplace; DHI leadership committed to advancing all three toward production. The winning marketplace uses an MCP server, Amazon Bedrock AgentCore, Lambda functions, session memory, and Claude 3.5 Haiku to let recruiters search candidates and enrich profiles through natural-language requests. The post concludes that time-boxed, cross-functional hackathons can compress ideation, architecture, prototyping, executive alignment, and production planning when production criteria and preparation are established upfront.
From zero-shot forecast to purchase order with Amazon Bedrock AgentCore
This post presents an inventory automation architecture that moves from zero-shot demand forecasts to validated purchase orders while applying safety stock, minimum order quantities, budgets, and promotional adjustments. It combines Amazon Chronos2, hosted on SageMaker Serverless Inference, with four Claude-powered agents built using the Strands Agents SDK and deployed on Amazon Bedrock AgentCore; deterministic Python tools perform computation and agents handle judgment. Product data and future covariates arrive through CSV files in S3, while business rules remain in JSON, enabling what-if forecasts and onboarding without per-SKU training. In internal testing across 50 SKUs over a four-week horizon, the system reached 12.3% median WAPE, reduced onboarding from 2–3 weeks to under five minutes, and lowered estimated monthly inference cost from about $1,091 to $15. A conditional retry loop surfaces budget violations for user decisions instead of silently truncating orders, with traces and evaluator scores supporting auditability.
Building resilient real-time streaming workers with Amazon DynamoDB leases
Managing hundreds of persistent outbound WebSocket connections requires explicit ownership because a failed worker can drop connections and stop data flow until they are reassigned. The described fleet-management pattern uses Amazon DynamoDB leases, conditional writes, and a global secondary index to ensure one worker owns each connection, renew ownership with heartbeats, and find expired leases for reconciliation. Amazon ECS on AWS Fargate workers poll Amazon SQS for notifications, maintain the WebSockets, and release or transfer ownership during graceful shutdown, failures, and scaling. The design also records desired state, the upstream URL, and the last processed sequence number in the lease item, while clock synchronization supports its time-based expiry. The post identifies heartbeat writes as the dominant DynamoDB cost and recommends provisioned capacity with Auto Scaling for sustained high connection counts, while noting that longer intervals reduce cost but extend failover.
Why don’t machine learning research agents overfit?
Repeatedly optimizing against long-lived machine-learning benchmarks appears to invite overfitting, yet the post notes that gains on heavily reused benchmarks have largely transferred to newly created test sets. It describes a paper that resets LLM-based research agents, gives an explorer repeated access to validation feedback, and passes the resulting strategy through a token bottleneck to a fresh reproducer. Across eight datasets, strategies from hundreds of experiments were reproducible from prompts as short as 16 to 32 tokens; at shorter budgets, performance diverged, showing that the compressed message carried data-dependent choices rather than only prior knowledge. Deliberate overfitting occurred in 38 of 102 runs, with validation accuracy more than 10% above held-out accuracy, but those gains disappeared after compression; possible pretraining side channels remain unresolved.
Testing application resilience with Amazon SQS and AWS Fault Injection Service
The post presents a resilience-testing tutorial for applications that depend on Amazon Simple Queue Service (Amazon SQS), where failed queue operations can stall downstream processing and trigger cascading outages. It uses AWS Fault Injection Service (AWS FIS) and AWS Systems Manager (SSM) Automation to apply a scoped deny resource policy that blocks data-plane actions, including sending, receiving, deleting, changing visibility, and purging, while preserving queue management. The experiment increases disruption across four phases, then observes producer-side and consumer-side behavior through application and Amazon CloudWatch metrics, including circuit-breaker state, failed sends, backlog, message age, duplicates, and dead-letter-queue effects. The guidance emphasizes hypotheses with measurable success criteria, non-production guardrails, tagged target queues, and a stop condition based on customer impact. It also describes consumer-only, partial, and compound-failure extensions, warning that concurrent experiments on one queue can leave a stale deny policy.
Validating multi-Region DR for Terraform Enterprise with AWS FIS
Athenahealth’s single-Region Terraform Enterprise deployment became inaccessible to developers during an October 2025 AWS regional service event, exposing missing regional failover capabilities. The post describes a customer-operated active-passive design spanning us-east-1 and us-west-2, using Aurora PostgreSQL-Compatible global databases, bidirectional S3 cross-Region replication, Route 53 health checks, and compute scaled to zero in the DR Region. AWS Fault Injection Service experiments validate three phases of recovery, including failover, failback, and disruptions that can reveal dependencies such as state-file lookups or S3 connectivity. The resulting architecture achieved a validated 12–14 minute RTO and less than one minute RPO, while costing approximately 30–40% more than the single-Region deployment. The design is presented as an option for critical workloads rather than a supported multi-Region TFE product configuration.
Hybrid cloud orchestration: Modernizing on-premises infrastructure management with AWS
Managing distributed on-premises infrastructure across hundreds of sites creates inconsistency, manual lifecycle bottlenecks, fragmented visibility, and scalability problems, especially when hardware, operating system, Kubernetes, and application operations span thousands of servers. The proposed design centralizes orchestration in AWS while keeping execution on site, using hybrid connectivity, AWS Lambda, AWS Step Functions, Amazon EventBridge, DynamoDB, AWS Systems Manager, and supporting services. Redfish APIs provide vendor-agnostic bare-metal control for BIOS, firmware, power, and health operations, while EKS Anywhere deploys and operates management and workload clusters on local hardware; orders and inventory records track workflows and resource relationships. DynamoDB Streams also automate DNS, certificates, AWS access, and storage integrations, while centralized observability aggregates server, cluster, and application signals; the post presents architectural patterns and defers detailed implementation workflows and templates to later parts.
MCP went stateless: Is your AWS MCP server deployment well-architected?
MCP 2026-07-28 removes the initialize handshake and Mcp-Session-Id, making the protocol core stateless and changing how remote servers scale on AWS. Requests carry protocol version and client context, while server/discover can expose versions, capabilities, and identity; continuity remains possible through server-minted identifiers passed in tool arguments and stored application state. It covers round-robin routing, header-based gateway signals, cache freshness fields, W3C Trace Context, idempotent tools, and Multi Round-Trip Requests for input-dependent calls. It recommends retaining sticky routing and session stores for 2025-era clients, then migrating after legacy traffic reaches zero and validating against the official conformance suite. The conclusion is that the revision aligns remote MCP deployments with AWS Well-Architected practices and permits removal of infrastructure required only by the old protocol.
Developing provably correct Rust code with Verus
Rust’s type system prevents many memory-safety bugs, but it does not prove that programs compute intended results, avoid leaks, or correctly handle every unsafe and concurrent operation. Verus is an open-source automated program verifier that checks Rust implementations against formal specifications for all possible inputs, using solvers to discharge proof obligations while developers provide guidance such as loop invariants. Specifications and proofs use Rust-like requires and ensures annotations written alongside the code, while ordinary Rust compilers ignore them and Verus typically returns feedback in under a second. The tool can prove properties of unsafe code, lock invariants, and concurrent systems, and Amazon has used it for key Nitro Isolation Engine primitives and other critical infrastructure.
Gallup scales real-time coaching for thousands with Amazon Bedrock
Gallup needed to centralize decades of proprietary workplace performance research to provide proactive, real-time coaching for organizational leaders directly within their daily workflows. To solve this challenge, Gallup developed Gallup AI inside its Gallup Access platform using Amazon Bedrock and Anthropic Claude models. The multi-tenant serverless architecture leverages Amazon Bedrock Knowledge Bases and Amazon Kendra for retrieval-augmented generation, while AWS Lambda with FastAPI powers real-time streaming responses. Amazon ElastiCache Serverless caches recent conversation history for sub-millisecond session retrieval, Amazon RDS for MySQL provides durable transactional storage, and Amazon Bedrock Guardrails enforce content safety. Since its June 2024 launch, the system has achieved sub-second time-to-first-byte streaming latency while prompt volume grew approximately sevenfold across thousands of organizations.
Closing the AI agent trust gap with graduated autonomy
Operating AI agents under binary full-access or read-only permissions creates an operational trust gap due to unpredictable model behavior across updates. The graduated autonomy architectural pattern closes this gap by dynamically granting or revoking tool permissions through sustained reliability scoring. A scoring engine computes a composite score across five weighted dimensions over a rolling 50-action window, mapping agents across four tiers from probation to full autonomy. In-process pre-execution filters check for prompt injection and sensitive targets, while Amazon Bedrock AgentCore Gateway and Cedar policies strictly enforce deny-by-default access at the infrastructure level. Post-execution state capture in Amazon DynamoDB supports reversibility, and AWS CodePipeline delivery gates block releases failing adversarial evaluation benchmarks.
How a global payment processor preserved AWS RAM shares and Lake Formation permissions during an AWS Organizations migration
A global payment processor migrating 382 AWS accounts between AWS Organizations encountered control-plane failures when AWS Resource Access Manager automatically severed organization-bound resource shares. Although data planes continued operating for shared resources such as AWS Transit Gateways, infrastructure automation lost the ability to modify dependencies like AWS Glue Data Catalog databases. The engineering team resolved this by implementing temporary retained bridge shares, establishing external principal associations that survived cross-organization account transfers. Following each account move, automated tooling restored durable original shares, validated Lake Formation permissions, and deleted the bridge copies to prevent configuration drift. This bridge-share workflow enabled the migration of 378 accounts before a Transitional Service Agreement deadline without customer downtime.
Build a unified AI agent architecture with DynamoDB and Bedrock
AI agent architectures on AWS frequently divide operational records and vector embeddings across separate databases, creating synchronization lag and infrastructure overhead. To resolve this fragmentation, a single DynamoDB table can store operational document attributes alongside embeddings by leveraging native vector search. An Amazon Bedrock agent directs incoming queries to AWS Lambda action groups, which run standard CRUD operations or semantic searches against the DynamoDB SearchVectors API. When items change, a DynamoDB Streams pipeline uses Amazon Titan Text Embeddings V2 to generate new embeddings and write them back to the table. This unified approach eliminates standalone vector databases while keeping semantic indexes synchronized with operational updates.
How AgentFlo built AI sales agents with Amazon Bedrock AgentCore – Part 2
AgentFlo designed an architecture using Amazon Bedrock AgentCore and AWS serverless infrastructure to address traffic spikes and build trust in autonomous commerce agents. Security operates across three stages: AWS Fargate filters prompt injections and opt-outs, AgentCore Gateway enforces deterministic Cedar authorization policies during tool execution, and post-turn privacy filters screen outputs. Session isolation is maintained across merchants through AgentCore runtime microVMs, while AgentCore Observability and Amazon CloudWatch provide end-to-end tracing. Data reliability and long conversation journeys rely on Amazon DynamoDB context storage, Amazon Bedrock Knowledge Bases, and Amazon S3 Vector embeddings. Early deployment data showed a 12 percent net revenue uplift.
How AgentFlo built AI sales agents with Amazon Bedrock AgentCore – Part 1
AgentFlo built autonomous AI sales agents to address cart abandonment, unassisted messaging channels, and severe traffic spikes across eCommerce platforms. The system uses the Strands Agents SDK alongside Amazon Bedrock AgentCore to manage intent, recommend products, and execute transactions. Incoming customer communications pass through AWS Fargate before entering AgentCore runtime, which executes model-driven agents inside isolated microVMs with stateful sessions lasting up to eight hours. Tool execution is brokered separately through AgentCore Gateway to ensure operations like cart modifications scale independently from model reasoning. This deployment model enables merchants to launch specialized conversational agents in minutes without pre-provisioning capacity or maintaining custom container configurations.
How Clario technology detects PHI/PII in DICOM images using Amazon Bedrock
Clario developed an automated PHI and PII detection solution on AWS to process thousands of DICOM image slices and PDF files in clinical trials. Medical imaging workflows require strict privacy compliance under HIPAA, GDPR, and ICH E6 guidelines across standard tags, custom vendor metadata, and pixel-burned text. To address this, the pipeline retrieves files from Amazon S3 and runs memory-intensive detection workloads on Amazon EKS backed by Amazon RDS for PostgreSQL. Amazon Textract handles optical character recognition, while Anthropic's Claude Sonnet on Amazon Bedrock classifies sensitive data using domain-optimized prompt engineering. The system identifies precise coordinates and sensitive entity types rather than directly altering files, enabling human-in-the-loop review before downstream redaction occurs.
AI-powered clinical trial eligibility and safety using Amazon Bedrock AgentCore
Manual chart review across fragmented clinical sources slows clinical trial enrollment, contributing to timeline delays and high screen failure rates. To address this bottleneck, an architecture on AWS automates eligibility and safety assessments while preserving human clinician authority. AWS HealthLake ingests and normalizes records into FHIR R4 resources, while Amazon Bedrock AgentCore orchestrates pre-screening, detailed screening, and site enrollment agents. Amazon Bedrock AgentCore Evaluations scores screening determinations using an LLM-as-a-judge approach for clinical accuracy, operational effectiveness, and safety compliance. This human-in-the-loop workflow produces structured recommendations with source citations, reducing patient matching time from days to minutes while maintaining compliance audit trails.
Consistency is the new latency: AI at the data layer
Autonomous AI agents depend on the accuracy of the underlying data layer because retrieved data populates the LLM context window for multi-step reasoning. In distributed architectures, standard asynchronous replication lag causes agents to ingest stale data, leading to flawed execution and self-reinforcing hallucination debt when errors are saved back to memory. To resolve this, architectures must align replication strategies with specific task truth requirements across three primary patterns. High-stakes workloads utilize Amazon Aurora with global write forwarding or native Aurora DSQL for multi-region strong consistency, while high-scale scenarios leverage DynamoDB Global Tables with conditional writes to prevent lost updates. Finally, high-velocity ingestion pipelines enforce LOCAL_QUORUM reads and writes in Amazon Keyspaces to capture critical data spikes reliably.
Serverless vehicle tracking at scale: Bosch L.OS on AWS
Bosch Mobility Platform Solutions developed the Logistics Operating System on AWS to unify vehicle tracking across fragmented spot logistics markets. The system standardizes multiple telematics providers, disparate data formats, and diverse communication protocols into a centralized visibility layer. Orchestration is handled by a Tracking Connector running on Amazon ECS with AWS Fargate, while AWS Lambda functions act as provider-specific adapters for protocol translation. Event-driven message ingestion and streaming rely on Amazon MSK, complemented by Amazon ElastiCache for low-latency caching and Amazon DynamoDB for compliance policy enforcement. Currently operational in India with ten integrated ISVs, the platform reportedly reduces integration costs by 15–20% and lowers total tracking costs for small transporters by 25–30%.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.