Implementation Guides
How the architecture is systematically built, automated, and operated — phase-by-phase build plans with validation, pitfalls, and a diagram for every step.
Build a Hybrid LLM Router on AWS for Under $1 an Hour
A from-zero workshop for a gateway that sends routine LLM requests to a self-hosted model on a spot GPU and everything else to Claude on Amazon Bedrock. Eight phases — network, a LiteLLM gateway on ECS Fargate, EKS 1.37, model weights on EFS, Karpenter + KEDA + Prometheus, vLLM 0.32 serving Qwen2.5-7B-Instruct-AWQ on a spot g4dn/g5/g6 node, a routing test, and an ordered teardown — each with the commands, the check that proves it worked, and how to undo it. Every number was measured on a real build: $0.65–$0.90 an hour at us-east-1 list prices, a 9–11 minute GPU cold start dominated by the 9.2 GB image pull (weights load from EFS in 21–27 s), and a fallback captured live: with vLLM paused, the circuit breaker overruled a cached decision and Bedrock answered. Built, torn down and rebuilt twice from its own instructions; the 15 pitfalls it hit, from staged Terraform applies to a Service name that crashes vLLM, are in a table with their fixes. Code is public on GitHub.
Release Engineering from Scratch: Build Once, Prove Origin, Version the Mesh
A hands-on build of a real release system from an empty repo. Branch for continuous delivery (trunk-based, not git-flow — its own creator says so); build one immutable artifact and promote the same digest dev to prod (never rebuild); prove where it came from with signing AND provenance (a signature isn't provenance — SolarWinds shipped a validly-signed backdoor), via cosign + SLSA; and the part everyone underestimates — versioning interdependent components without shipping a diamond-shaped disaster (SemVer is an estimate, Changesets/release-trains coordinate it). Real cosign / SLSA-provenance / Changesets / CI config. Every claim sourced.
Account Factory for Terraform (AFT): A Step-by-Step Build
Turn AWS account creation into a git push. This guide stands up Control Tower Account Factory for Terraform in seven phases — deploy the framework from one module (run with Control Tower management-account credentials), wire up the four repos, vend your first account from a verbatim account_request .tf, then baseline it with global and per-account customizations. With the real module inputs, the numbered end-to-end provisioning flow, version pinning, and the black-box gotchas (apply-only-from-default-branch, batches of 5, invoke-success ≠ pipeline-success). Every claim sourced.
GitHub Actions → AWS via OIDC — Implementation (Terraform)
The hands-on build of keyless CI/CD from GitHub Actions to AWS — no long-lived access keys. The trust model (GitHub mints a short-lived JWT per job; AWS STS exchanges it via AssumeRoleWithWebIdentity), the account-boundary rule (one IAM OIDC provider per account, same account as the role), the exact config that makes it work: the provider for token.actions.githubusercontent.com with audience sts.amazonaws.com, an IAM role whose trust policy conditions on aud and a tightly-scoped sub (branch or GitHub Environment) plus a least-privilege permissions policy, the workflow's id-token: write and aws-actions/configure-aws-credentials@v6, the sub-wildcard footgun and fork-PR risk, debugging 'Not authorized to AssumeRoleWithWebIdentity' denials, and the Terraform module topology (shared provider + per-repo role) across multiple accounts. 27 build steps with a diagram for each.
Centralized Egress Inspection — Build It (Terraform, multi-account)
The hands-on build of the centralized-egress pattern in Terraform across accounts: a dedicated network account owns the Transit Gateway (shared to spokes via AWS RAM, auto-accepted through Organizations) and the inspection/egress VPC. The exact resources and their wiring — TGW route tables with the spoke-to-spoke blackhole, the three subnet tiers per AZ, AWS Network Firewall (rule groups → policy → firewall with a per-AZ endpoint), reading firewall_status.sync_states for the endpoint id, the full route chain (TGW subnet → firewall → NAT → IGW), HOME_NET across every spoke CIDR, end-to-end validation, plus day-2 logging and the module topology with a spoke-vending template. 27 build steps with a diagram for each.
Build an Agent Factory on Amazon Bedrock AgentCore (AWS, CLI/CDK)
The same factory built on AgentCore's GA runtime, not classic Bedrock Agents: ownership & IAM boundaries (the bedrock-agentcore.amazonaws.com execution-role trust + iam:PassRole), a reusable AgentCore project template (agentcore.json + app/<agent>/main.py + a least-privilege execution role) deployed to a Runtime endpoint, governed tools via Gateway, Identity (JWT-only) + Memory + Guardrails, observability & endpoint rollback, and the control-plane/per-agent 4-stack split — each step with validation and the real pitfalls (wrong service principal, iam:PassRole, the >53-layer/non-numeric-USER container, GetWorkloadAccessTokenForUserId escalation, LTM provisioning). Anchored to the AWS AgentCore CLI + runtime-permissions docs; Container-build, code-based-agent variant.
Build an AI Agent Factory on AWS (Bedrock Agents + Terraform)
How to build a thin AI Agent Factory: ownership & IAM boundaries, a reusable Terraform agent-template module (agent + action-group Lambda + scoped service role + Guardrail + alias), a vending pipeline that Prepares → versions → aliases each agent, governance gates, observability & alias-rollback, and the control-plane/template module split — each step with validation and the real pitfalls (the Prepare→alias race, the mandatory Lambda resource-based policy). Anchored to AWS's Terraform agent-lifecycle reference; classic Bedrock Agents variant.
Centralized Ingress — Implementation (AWS, Terraform)
How to build it — the firewall-first edge model from the AWS Multi-VPC whitepaper: ownership & RAM boundaries, the packet-by-packet route-table matrix, state mechanics & failure domains, and the three-module Terraform topology — with validation and pitfalls per phase, and the cross-TGW inspection variant named as the alternative.
Cable to Commit — A Live Map of Metro NDM
A non-disruptive VMAX→PowerMax array migration, drawn on one interactive canvas. Thick grey lines are physical cables; thin coloured lines over them are zones; a cable with no colour is plugged in and doing nothing — the distinction that trips people up. Step through all thirteen stages (the once-per-array-pair setup, the per-storage-group loop, and cleanup) and watch the cables, the three zone families, session state, and rollback change at each move — or press play. Plus how a cascaded initiator group makes one masking view cover a whole ESXi cluster, why every node must be rescanned before cutover, and the Metro specifics (shared-fabric bandwidth, adaptive-copy sync, bias, readytgt, sync-stop) worth knowing before you run it for real.
Zone the Arrays, Zone the Hosts, Migrate the Storage Groups
A working cheat sheet for a Metro-based NDM migration, on one canvas that never moves. The job is really three jobs: zone the two arrays' RF ports to each other, zone every ESXi host to the target array's FA ports, then run each storage group through create, cutover and commit. Step through all nineteen moves and watch cables, zones, host I/O and SRDF replication change state, with the exact Brocade and SYMCLI commands for each step beside the diagram — including how a port is moved off an FA emulation slice onto an RF slice in the first place. Plus the full command reference, the session states you will see, the go/no-go prerequisites, and the traps that actually cost downtime: editing a shared zone, activating the wrong config, removing source zones early, and the post-cutover rescan that quietly kills your revert.
No posts match — try a different keyword or clear the filters.