Engineering & Life

Jayanth's Blog

Thoughts on AWS, Terraform, Kubernetes, platform engineering, and the quieter things in life.

260Posts

19Topics

2776Min of reading

Sep 18, 2026Latest

$ |

260 posts

AWS Weekly LabSep 18, 2026

Week 19 - GitOps on EKS: Should You Run Argo CD, or Let AWS?

Deploying to Kubernetes by hand does not scale past about one person. Somebody runs kubectl apply from a laptop, the cluster drifts away from what is in Git, an…

AWS Daily IntelligenceSep 18, 2026

AWS Daily Intelligence #35 - The environment per application was the ceiling

Elastic Beanstalk has introduced Cluster Mode , described as “a new deployment mode that lets you run and manage multiple applications on shared infrastructure…

GCP Architecture SeriesSep 18, 2026

GCP Architecture Series #36 — Deny Policies: Syntax, Evaluation Order and Denial Conditions

#35 ended on the observation that the deny policy permissions are among the handful you cannot put in a custom role. This post is about what that restriction pr…

Azure Architecture SeriesSep 18, 2026

Azure Architecture Series #37 — Workload Identity Federation

Managed identities solve credential handling for things running inside Azure. Posts #35 and #36 were about that. The obvious question is what happens to everyth…

AWS Architecture SeriesSep 18, 2026

AWS Architecture Series #56 — The blast radius was decided by a field name

The previous post ended with a queue that could not tell you which of its problems it had. This one is about the case where the answer is “one customer” — and a…

AWS Daily IntelligenceSep 17, 2026

AWS Daily Intelligence #34 - The limit you could hit but never measure

AWS STS “now enforces a single 4,096-byte size limit on session tokens” , replacing what were previously “separate limits on session token size and passed-in pa…

GCP Architecture SeriesSep 17, 2026

GCP Architecture Series #35 — Custom Roles: Launch Stages, and the Permissions You Cannot Grant

#32 introduced custom roles and their maintenance burden. This is the mechanical layer underneath: what you are actually allowed to put in one, and what the lau…

Azure Architecture SeriesSep 17, 2026

Azure Architecture Series #36 — Managed Identity on VMs, App Service, Functions and AKS

Post #35 argued for managed identities on their merits: no credential, no licence, no cost, and a user-assigned identity that behaves as the unit of authorisati…

AWS Architecture SeriesSep 17, 2026

AWS Architecture Series #55 — The oldest message is not the oldest message

The previous post ended on a fleet of polite clients overwhelming a dependency, and the standard answer to that: put a queue in front of it. This post is about…

AWS Daily IntelligenceSep 16, 2026

AWS Daily Intelligence #33 - The root alarm was watching one Region

AWS has made root user sign-in regionally resilient: it “is now served across US East (N. Virginia), US East (Ohio), and US West (Oregon), with sign-in traffic…

GCP Architecture SeriesSep 16, 2026

GCP Architecture Series #34 — Inheritance in Practice: Tracing Why an Account Has Access

#33 established that effective access is a union over the ancestry. This post is the operational consequence: given a principal and a resource, find the binding…

Azure Architecture SeriesSep 16, 2026

Azure Architecture Series #35 — Managed Identities: System-Assigned versus User-Assigned

Post #34 ended on the problem an app registration hands you: a credential to store, rotate and eventually leak. Managed identities are the answer, and the pitch…

AWS Architecture SeriesSep 16, 2026

AWS Architecture Series #54 — The herd is spread, not smaller

The last two posts made a pipeline safe to consume: idempotent handlers, then events that exist at all. This one is about the traffic those retries generate, wh…

AWS Daily IntelligenceSep 15, 2026

AWS Daily Intelligence #32 - The table had two writers and no owner

AWS Glue zero-ETL integrations now detect table property conflicts and track integration ownership , announced on Sunday.

GCP Architecture SeriesSep 15, 2026

GCP Architecture Series #33 — Allow Policies, Bindings, and the Union Rule

#31 covered principals and #32 covered roles. This post is the object that joins them, and it has exactly one arithmetic operation: addition.

Azure Architecture SeriesSep 15, 2026

Azure Architecture Series #34 — App Registrations and Service Principals

Phase 2 has spent three posts on human identity: what it costs, how it is contained, how it is automated. This post is the turn to workload identity, and it sta…

AWS Architecture SeriesSep 15, 2026

AWS Architecture Series #53 — The write was atomic. The event was not.

The previous post established idempotency — the property that makes an at-least-once pipeline safe to consume. This one is about getting the events into that pi…

GCP Architecture SeriesSep 14, 2026

GCP Architecture Series #32 — Roles: Basic, Predefined and Custom

Post #31 took one half of a binding. This is the other half, and the half where most of the received wisdom is now out of date.

Azure Architecture SeriesSep 14, 2026

Azure Architecture Series #33 — Dynamic Membership Rules

Post #32 left a principle hanging: a rule that writes membership is a rule that writes privilege . That was an inference from why role-assignable groups forbid…

AWS Architecture SeriesSep 14, 2026

AWS Architecture Series #52 — The retry you did not write

The last four posts were about money. This one opens a different block — the patterns that decide whether a distributed system is correct — and it starts with t…

GCP Architecture SeriesSep 13, 2026

GCP Architecture Series #31 — IAM Principals: Users, Groups, Domains and Service Accounts

The principal is the half of a policy nobody reviews. All four of these come from choosing the wrong kind, or from not knowing what counts.

Azure Architecture SeriesSep 13, 2026

Azure Architecture Series #32 — Users, Groups and Administrative Units

The Azure resource model taught one reflex above all others: a container passes things down . A policy assigned at a management group applies to every subscript…

AWS Architecture SeriesSep 13, 2026

AWS Architecture Series #51 — The alarm rings after the money is gone

The last three posts were about what things cost, who owes it, and who gets the discount. This one is about the control that was supposed to prevent the convers…

AWS Weekly IntelligenceSep 12, 2026

AWS Weekly Intelligence #6 - 7-11 September 2026

Four working days, because Monday was Labor Day and the What’s New feed returned nothing at all. They still produced 53 announcements , and the most consequenti…

AWS

10

8

8

8

8

6

5

4

4

4

4

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Azure

GCP

177 AWS services across 166 AWS posts, 20 Azure across 49, 23 GCP across 45, by number of posts. Click one to filter; hover for what it does.