Loading…
Topic
202 posts about AWS. Every summary links to the original.
See the idea
Amazon Bedrock is the managed reasoning tier in an agent architecture, not the whole system. This layered view shows the pipelines, governed tables, query layer, and guardrails around it.
CloudFormation is a declarative reconciler: you describe the target state in a template, and it provisions, updates, and reports on the stack that results. Here is the loop.
Amazon EVS runs VMware Cloud Foundation on AWS bare metal, so the design question becomes where each workload's data lives. This layered diagram shows how vSAN, FSx for ONTAP, and cross-Region DR divide the work.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Anthropic announced a new agreement with Google and Broadcom for multiple gigawatts of next-generation TPU capacity expected to come online starting in 2027. The company says the expansion will support its frontier Claude models and meet customer demand, with most of the new compute sited in the United States as an expansion of its November 2025 commitment to invest $50 billion in American computing infrastructure. Anthropic reports that run-rate revenue surpassed $30 billion, up from approximately $9 billion at the end of 2025, while the number of business customers spending more than $1 million annually rose from over 500 to more than 1,000 in less than two months. It will continue using AWS Trainium, Google TPUs, and NVIDIA GPUs, and says Claude remains available across Amazon Web Services, Google Cloud, and Microsoft Azure.
Anthropic and Amazon have signed a new agreement to deepen their partnership and secure up to 5 gigawatts of capacity for training and deploying Claude. The deal includes Trainium2 capacity coming online in Q2, scaled Trainium3 capacity later this year, and nearly 1GW of combined Trainium2 and Trainium3 capacity by the end of 2026. Anthropic will commit more than $100 billion over ten years to AWS technologies, use AWS as its primary training and cloud provider, and make the Claude Platform available within AWS with existing account, controls, billing, governance and compliance arrangements. Amazon is investing $5 billion now, with up to $20 billion more later, building on $8 billion previously invested. The expansion responds to accelerated demand that has strained reliability and performance during peak hours.
Anthropic announces that Amazon will invest up to $4 billion and become its primary cloud provider for mission-critical workloads. The collaboration combines Anthropic’s frontier safety research and models with AWS infrastructure, including Trainium and Inferentia chips, while expanding Amazon Bedrock support for secure model customization and fine-tuning. Organizations will be able to use Claude 2 through Bedrock, including its 100,000-token context window, with examples spanning legal search, investment analysis, and travel recommendations; Lonely Planet reduced itinerary-generation costs by almost 80 percent after deployment. Amazon will take a minority stake, while Anthropic’s governance remains unchanged under the Long Term Benefit Trust and its Responsible Scaling Policy, including pre-deployment testing of new models.
Anthropic announces a partnership with Scale to bring Claude and generative AI applications to enterprises. Scale customers can now use Claude, Anthropic’s conversational AI assistant. Businesses can build applications on Claude using Scale’s deployment and management functionality, with expert prompt engineering and model validation available to improve performance and identify weaknesses. Scale’s enterprise-grade security is available through a customer’s private AWS environment, while data connectors can import proprietary sources including databases, Confluence, Google Drive, and Outlook. The post describes the combination of Claude, Anthropic’s Constitutional AI system, and Scale’s tooling as an enterprise-ready solution, and says the partners aim to bring Claude to more organizations responsibly.
The FDA built HALO (Harmonized AI and Lifecycle Operations for Data) as a secure, governed, AI-ready enterprise data platform for modernizing siloed systems without interrupting regulatory work. Its move to Databricks on AWS GovCloud, following FedRAMP High authorization sponsorship, added Unity Catalog as a governance layer across a multi-tenant architecture, while Terraform-based security patterns, PrivateLink, customer-managed keys, and the compliance security profile support regulated workloads. The agency migrated more than 5,000 users and 8,000 jobs and pipelines with zero downtime, refactoring over 1,000 pipelines and 4,000 notebooks. After onboarding eight centers and 30 programs, FDA reported query responses improving over 30%, compute costs falling over 20%, and provisioning and sharing time dropping over 75%. HALO also supports responsible AI use cases such as MARS, with humans retaining decision authority.
Managing distributed on-premises infrastructure across hundreds of sites creates inconsistency, manual lifecycle bottlenecks, fragmented visibility, and scalability problems, especially when hardware, operating system, Kubernetes, and application operations span thousands of servers. The proposed design centralizes orchestration in AWS while keeping execution on site, using hybrid connectivity, AWS Lambda, AWS Step Functions, Amazon EventBridge, DynamoDB, AWS Systems Manager, and supporting services. Redfish APIs provide vendor-agnostic bare-metal control for BIOS, firmware, power, and health operations, while EKS Anywhere deploys and operates management and workload clusters on local hardware; orders and inventory records track workflows and resource relationships. DynamoDB Streams also automate DNS, certificates, AWS access, and storage integrations, while centralized observability aggregates server, cluster, and application signals; the post presents architectural patterns and defers detailed implementation workflows and templates to later parts.
MCP 2026-07-28 removes the initialize handshake and Mcp-Session-Id, making the protocol core stateless and changing how remote servers scale on AWS. Requests carry protocol version and client context, while server/discover can expose versions, capabilities, and identity; continuity remains possible through server-minted identifiers passed in tool arguments and stored application state. It covers round-robin routing, header-based gateway signals, cache freshness fields, W3C Trace Context, idempotent tools, and Multi Round-Trip Requests for input-dependent calls. It recommends retaining sticky routing and session stores for 2025-era clients, then migrating after legacy traffic reaches zero and validating against the official conformance suite. The conclusion is that the revision aligns remote MCP deployments with AWS Well-Architected practices and permits removal of infrastructure required only by the old protocol.
Lyft migrated its fleet of hundreds of critical streaming jobs from an internally developed Flink Kubernetes operator to the open-source Apache Flink Kubernetes operator. The legacy system imposed maintenance burden, feature gaps, outdated dependencies, fragile savepoint handling, and a rigid memory model that complicated varied workloads, including Apache Beam applications. Lyft used an incremental migration designed to preserve deployment patterns and team workflows while addressing CRD translation, state-machine behavior, and operational compatibility. The new platform added explicit last-state upgrades, autoscaling, automatic memory tuning, and safer upgrade mechanisms, though autotuning required trade-offs with in-place autoscaling and node capacity planning. After the multi-quarter transition, maintenance burden was minimized, the autoscaler right-sized a fleet previously overprovisioned by a few million dollars annually, and Lyft could contribute fixes upstream instead of maintaining its own operator.
JetBrains reports a security incident affecting Cadence, its hosted service that integrates with PyCharm through an optional plugin and runs projects on cloud compute resources. Cadence used TeamCity to orchestrate workloads, and attackers exploited the environment through critical vulnerability CVE-2026-63077. The attackers accessed personal data, compromised a 2024 server backup and Cadence-related AWS IAM credentials, and accessed files in JetBrains AWS S3 buckets; the scope remains under investigation. JetBrains discovered the exploitation on August 23, took the server offline on August 24, invalidated plugin access tokens, and urges users to rotate secrets, investigate connected systems, review repositories, and treat executions and synchronized files as untrusted.
The post presents Lakebase Postgres as a design for agent workloads that need isolated copies, restores, replicas, historical queries, and many short-lived databases without repeatedly moving large datasets. It contrasts conventional data-centric OLTP with a transaction-centric model in which PostgreSQL’s write-ahead log (WAL) is the source of truth, with LSNs making database history addressable. Lakebase splits compute, which runs standard Postgres and uses RAM and local NVMe caches, from storage, where safekeepers replicate WAL through quorum acknowledgements, a pageserver materializes pages, and object storage retains immutable history. Commits wait for replicated WAL acknowledgement, not page uploads, while reads request pages at an LSN. The design supports point-in-time queries, cheap branch or read-only compute, scale-to-zero suspension, and shared transactional and analytical access, while still relying on RAM and NVMe for performance.
Anthropic, AWS, and Accenture announced a collaboration to help enterprises move generative AI ideas from concept to production, with an emphasis on regulated sectors where accuracy, reliability, and data security are paramount. More than 1,400 Accenture engineers will train as specialists in Anthropic models on AWS, supporting end-to-end delivery, customer-specific fine-tuning with private data, and prompt and platform engineering through Amazon Bedrock and Amazon SageMaker. In public health, the initiative has already produced Knowledge Assist, a Claude-powered chatbot built with the District of Columbia Department of Health that answers questions about health programs and services in English and Spanish. The collaboration combines Anthropic’s AI expertise, AWS’s security and reliability approach, and Accenture’s industry knowledge to develop tailored solutions for trust-driven sectors and streamline adoption of AI systems.
Gallup needed to centralize decades of proprietary workplace performance research to provide proactive, real-time coaching for organizational leaders directly within their daily workflows. To solve this challenge, Gallup developed Gallup AI inside its Gallup Access platform using Amazon Bedrock and Anthropic Claude models. The multi-tenant serverless architecture leverages Amazon Bedrock Knowledge Bases and Amazon Kendra for retrieval-augmented generation, while AWS Lambda with FastAPI powers real-time streaming responses. Amazon ElastiCache Serverless caches recent conversation history for sub-millisecond session retrieval, Amazon RDS for MySQL provides durable transactional storage, and Amazon Bedrock Guardrails enforce content safety. Since its June 2024 launch, the system has achieved sub-second time-to-first-byte streaming latency while prompt volume grew approximately sevenfold across thousands of organizations.
Operating AI agents under binary full-access or read-only permissions creates an operational trust gap due to unpredictable model behavior across updates. The graduated autonomy architectural pattern closes this gap by dynamically granting or revoking tool permissions through sustained reliability scoring. A scoring engine computes a composite score across five weighted dimensions over a rolling 50-action window, mapping agents across four tiers from probation to full autonomy. In-process pre-execution filters check for prompt injection and sensitive targets, while Amazon Bedrock AgentCore Gateway and Cedar policies strictly enforce deny-by-default access at the infrastructure level. Post-execution state capture in Amazon DynamoDB supports reversibility, and AWS CodePipeline delivery gates block releases failing adversarial evaluation benchmarks.
Databricks introduces Governance Hub, a beta account-level interface for platform and governance teams overseeing estates spanning hundreds of workspaces and multiple regions. It consolidates data health, access, AI usage, and cost information across AWS, Azure, and GCP, replacing scattered system tables, workspace views, and third-party tools with drill-downs for metadata gaps, principal access, token and model activity, and untagged spend. The hub also integrates with Genie, allowing users to ask governance questions in natural language and receive answers and recommendations grounded in governance data; future actions such as configuring policies and alerts are described as planned. Account admins enable it from the Account Console, with access varying by role and existing permissions respected, while upcoming features include performance and security insights and delegated recommendations.
A global payment processor migrating 382 AWS accounts between AWS Organizations encountered control-plane failures when AWS Resource Access Manager automatically severed organization-bound resource shares. Although data planes continued operating for shared resources such as AWS Transit Gateways, infrastructure automation lost the ability to modify dependencies like AWS Glue Data Catalog databases. The engineering team resolved this by implementing temporary retained bridge shares, establishing external principal associations that survived cross-organization account transfers. Following each account move, automated tooling restored durable original shares, validated Lake Formation permissions, and deleted the bridge copies to prevent configuration drift. This bridge-share workflow enabled the migration of 378 accounts before a Transitional Service Agreement deadline without customer downtime.
LogHouse’s OpenTelemetry pipeline ingests 50 million events per second and stores 177 PiB of uncompressed data, but its initial agent-to-gateway design could not reliably absorb ClickHouse backpressure. In-memory queues caused instability during short-lived spikes or database outages, while local collector write-ahead logs made gateways stateful, slowed recovery, delayed fresh telemetry behind FIFO backlogs, and took about four hours to drain 1 TiB. The team rejected adding Kafka because operating a new tier-zero service across cloud regions was not justified for this use case, then designed a custom architecture using blob storage, the OTel failover connector, overflow notifications, and a catchup collector. In staging, failover redirected 120,000 events per second to S3 without changing gateway resource usage, and recovery resumed ClickHouse writes while the catchup collector drained the queue; the design scaled from 10 million to 50 million events per second, with added regional setup and less precise recovery visibility.
AI agent architectures on AWS frequently divide operational records and vector embeddings across separate databases, creating synchronization lag and infrastructure overhead. To resolve this fragmentation, a single DynamoDB table can store operational document attributes alongside embeddings by leveraging native vector search. An Amazon Bedrock agent directs incoming queries to AWS Lambda action groups, which run standard CRUD operations or semantic searches against the DynamoDB SearchVectors API. When items change, a DynamoDB Streams pipeline uses Amazon Titan Text Embeddings V2 to generate new embeddings and write them back to the table. This unified approach eliminates standalone vector databases while keeping semantic indexes synchronized with operational updates.
Netflix operates over 30,000 Apache Flink jobs across multiple AWS regions, ranging from managed pipelines to complex stateful DAGs. Its initial in-house autoscaler used external telemetry from Mantis and Atlas to scale TaskManagers as a single unit, cutting resource usage by 25–45% but failing on multi-operator stateful topologies. To address these limitations, Netflix adopted the Apache Flink Autoscaler library, which calculates True Processing Rate and per-vertex parallelism using internal metrics. The architecture uses Temporal workflows orchestrated within a Spring Boot application to evaluate jobs individually and prevent cross-job blast radiuses. Implementing the open-source autoscaler reduced annualized compute expenditures by 58% for client telemetry and logging, saving approximately $1.1 million.
AgentFlo designed an architecture using Amazon Bedrock AgentCore and AWS serverless infrastructure to address traffic spikes and build trust in autonomous commerce agents. Security operates across three stages: AWS Fargate filters prompt injections and opt-outs, AgentCore Gateway enforces deterministic Cedar authorization policies during tool execution, and post-turn privacy filters screen outputs. Session isolation is maintained across merchants through AgentCore runtime microVMs, while AgentCore Observability and Amazon CloudWatch provide end-to-end tracing. Data reliability and long conversation journeys rely on Amazon DynamoDB context storage, Amazon Bedrock Knowledge Bases, and Amazon S3 Vector embeddings. Early deployment data showed a 12 percent net revenue uplift.
Databricks has expanded Inbound Private Link in Beta on AWS and Azure to cover account-level resources, including account-level Genie One, the account console, Governance Hub, and account-level APIs. The update also supports custom URLs and Managed Disaster Recovery stable URLs, while one shared General Access endpoint in any region can serve workspace and account-level UI and API resources, removing the need for one endpoint per region or workspace. These capabilities use context-based ingress, where account admins define allow and deny rules by caller identity, network source, and destination through account and workspace policies. Enabling private access to account-level resources requires registering and allowlisting a General Access endpoint with the account-policy and resolving the custom URL to that endpoint. Existing workspace-specific URLs, private access settings, and IP access lists continue to work in parallel, while service-direct and SCC relay endpoints retain per-region requirements.
The best engineering reads, once a week.
