Engineering & Life

Jayanth's Blog

Thoughts on AWS, Terraform, Kubernetes, platform engineering, and the quieter things in life.

403Posts

19Topics

4657Min of reading

Oct 19, 2026Latest

$ |

403 posts

Azure Architecture SeriesOct 19, 2026

Azure Architecture Series #67 — Effective Security Rules, and Diagnosing a Blocked Flow

Here is what the last six posts have accumulated between a packet and a virtual machine. A subnet NSG and a NIC NSG, evaluated in opposite orders depending on d…

GCP Architecture SeriesOct 19, 2026

GCP Architecture Series #67 — Internal and External IP Addresses, Static and Ephemeral

Six posts have been about ranges. This one is about the addresses drawn from them, and it turns on a distinction that the vocabulary actively obscures. Static a…

AWS Architecture SeriesOct 19, 2026

AWS Architecture Series #87 — The backup AWS cannot read, and you cannot restore without them

CloudHSM is where you put keys when "AWS can technically access this" is not an acceptable answer. The backup documentation makes the strong claim that justifie…

AWS Weekly LabOct 18, 2026

Week 23 - Service Networking with VPC Lattice: Who May Call This Service

Your orders app calls your rates app. How do you control who is allowed to make that call?

Azure Architecture SeriesOct 18, 2026

Azure Architecture Series #66 — Application Security Groups

A note on the previous two posts. #64 established that a subnet NSG applies to every resource in the subnet, and #65 that the default inbound allow admits the w…

GCP Architecture SeriesOct 18, 2026

GCP Architecture Series #66 — The Addresses Reserved in Every Subnet

This number has appeared in four of the last five posts and been deferred every time. Google Cloud uses the first two and last two IPv4 addresses in each subnet…

AWS Architecture SeriesOct 18, 2026

AWS Architecture Series #86 — Revocation has a start time, and it only moves backwards

“AWS Signer is a fully managed code-signing service to ensure the trust and integrity of your code.” The reason to care about it is the moment it is designed fo…

AWS Weekly IntelligenceOct 17, 2026

AWS Weekly Intelligence #11 - 12-16 October 2026

65 announcements across five working days — close to double the week before, with the volume in agent tooling and Region expansions, and the week's actual argum…

AWS Daily IntelligenceOct 17, 2026

AWS Daily Intelligence #56 - On for the new plans, off for the ones that have drifted

ARC Region switch picked up four capabilities on Tuesday. The one worth your afternoon is the quota parity check — and specifically the sentence in its document…

GCP Weekly IntelligenceOct 17, 2026

GCP Weekly Intelligence #10 - 12-16 October 2026

236 notes across 54 products and five days, up from 157 — and unusually, the volume is not the story. Four separate things shipped as coordinated multi-product…

Azure Weekly IntelligenceOct 17, 2026

Azure Weekly Intelligence #10 - 12-16 October 2026

Seven announcements across five working days — down from twenty the week before and thirty-nine the week before that, and the thinnest official channel since th…

GCP Architecture SeriesOct 17, 2026

GCP Architecture Series #65 — Expanding a Subnet, and What Cannot Be Undone

Three posts have now deferred something to this one. #61 noted the asymmetry, #63 called the primary range the only forgiving decision in a subnet, and #64 cont…

Azure Architecture SeriesOct 17, 2026

Azure Architecture Series #65 — The Default NSG Rules Everyone Forgets

#64 showed the six rules Azure writes into every NSG and left them as the floor of the priority stack. This post is about what they actually say, because five o…

AWS Architecture SeriesOct 17, 2026

AWS Architecture Series #85 — Every limit binds hardest on the busiest day

“Amazon Detective helps you analyze, investigate, and quickly identify the root cause of security findings or suspicious activities.” It is a tool for after. So…

GCP Weekly LabOct 16, 2026

Week 9 — The Service Accounts Nobody Ever Used

Every project in Google Cloud quietly comes with a login attached. You do not ask for it, you are not told about it, and it stays there for as long as the proje…

Azure Architecture SeriesOct 16, 2026

Azure Architecture Series #64 — Network Security Groups: Rules and Evaluation Order

Every post since #61 has referred to Network Security Groups without explaining them. This is that post, and it opens on the detail that is almost never taught…

AWS Daily IntelligenceOct 16, 2026

AWS Daily Intelligence #55 - Advisory, and on the critical path

Resilience Hub now attaches an AI investigation to every resilience test run on a connected service. The documentation is unusually careful about what that inve…

GCP Architecture SeriesOct 16, 2026

GCP Architecture Series #64 — Secondary Ranges and Alias IP

The previous post left subnets as allocation units with four settings attached, and noted that a subnet boundary no longer carries routing or identity. This pos…

AWS Architecture SeriesOct 16, 2026

AWS Architecture Series #84 — A view limits what it returns, not who can use another one

“AWS Resource Explorer is a resource search and discovery service.” That sentence makes it sound like a convenience, and for most of its life in an account it i…

AWS Daily IntelligenceOct 15, 2026

AWS Daily Intelligence #54 - Your naming convention is now a security input

Security Hub now ranks exposures by how critical the affected resource is. Most of the announcement is about the automation rule you can write. The sentence tha…

Azure Weekly LabOct 15, 2026

Week 9 — Nothing Runs Until Someone Asks

An internal tool gets used nine times a day, all of them between 9am and 5pm, all of them by the same four people. On a virtual machine it costs the same at 3am…

GCP Architecture SeriesOct 15, 2026

GCP Architecture Series #63 — Subnet Design and Primary IP Ranges

The last two posts settled what a VPC network is and which mode to create it in. Custom mode, the recommendation, leaves you holding the thing auto mode was doi…

Azure Architecture SeriesOct 15, 2026

Azure Architecture Series #63 — Subnet Delegation and Service Injection

The last two posts were about address space in the abstract: what Azure takes from every subnet, and how to hand out ranges that survive a merger. This one is a…

AWS Architecture SeriesOct 15, 2026

AWS Architecture Series #83 — The health check that raises the alarm threshold

Five posts in this block have been about access — who may do what, and whether the system knows. This one is about availability, and it has the same shape: a si…

AWS

↗108

13

13

12

10

9

9

9

8

7

7

6

6

5

5

5

4

4

4

4

4

4

3

3

3

3

3

3

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Azure

GCP

216 AWS services across 227 AWS posts, 23 Azure across 90, 25 GCP across 86, by number of posts. Click one to filter; hover for what it does.