Implementation Guides
How the architecture is systematically built, automated, and operated — phase-by-phase build plans with validation, pitfalls, and a diagram for every step.
Release Engineering from Scratch: Build Once, Prove Origin, Version the Mesh
A hands-on build of a real release system from an empty repo. Branch for continuous delivery (trunk-based, not git-flow — its own creator says so); build one immutable artifact and promote the same digest dev to prod (never rebuild); prove where it came from with signing AND provenance (a signature isn't provenance — SolarWinds shipped a validly-signed backdoor), via cosign + SLSA; and the part everyone underestimates — versioning interdependent components without shipping a diamond-shaped disaster (SemVer is an estimate, Changesets/release-trains coordinate it). Real cosign / SLSA-provenance / Changesets / CI config. Every claim sourced.
Account Factory for Terraform (AFT): A Step-by-Step Build
Turn AWS account creation into a git push. This guide stands up Control Tower Account Factory for Terraform in seven phases — deploy the framework from one module (run with Control Tower management-account credentials), wire up the four repos, vend your first account from a verbatim account_request .tf, then baseline it with global and per-account customizations. With the real module inputs, the numbered end-to-end provisioning flow, version pinning, and the black-box gotchas (apply-only-from-default-branch, batches of 5, invoke-success ≠ pipeline-success). Every claim sourced.
GitHub Actions → AWS via OIDC — Implementation (Terraform)
The hands-on build of keyless CI/CD from GitHub Actions to AWS — no long-lived access keys. The trust model (GitHub mints a short-lived JWT per job; AWS STS exchanges it via AssumeRoleWithWebIdentity), the account-boundary rule (one IAM OIDC provider per account, same account as the role), the exact config that makes it work: the provider for token.actions.githubusercontent.com with audience sts.amazonaws.com, an IAM role whose trust policy conditions on aud and a tightly-scoped sub (branch or GitHub Environment) plus a least-privilege permissions policy, the workflow's id-token: write and aws-actions/configure-aws-credentials@v6, the sub-wildcard footgun and fork-PR risk, debugging 'Not authorized to AssumeRoleWithWebIdentity' denials, and the Terraform module topology (shared provider + per-repo role) across multiple accounts. 27 build steps with a diagram for each.
Centralized Egress Inspection — Build It (Terraform, multi-account)
The hands-on build of the centralized-egress pattern in Terraform across accounts: a dedicated network account owns the Transit Gateway (shared to spokes via AWS RAM, auto-accepted through Organizations) and the inspection/egress VPC. The exact resources and their wiring — TGW route tables with the spoke-to-spoke blackhole, the three subnet tiers per AZ, AWS Network Firewall (rule groups → policy → firewall with a per-AZ endpoint), reading firewall_status.sync_states for the endpoint id, the full route chain (TGW subnet → firewall → NAT → IGW), HOME_NET across every spoke CIDR, end-to-end validation, plus day-2 logging and the module topology with a spoke-vending template. 27 build steps with a diagram for each.
Build an Agent Factory on Amazon Bedrock AgentCore (AWS, CLI/CDK)
The same factory built on AgentCore's GA runtime, not classic Bedrock Agents: ownership & IAM boundaries (the bedrock-agentcore.amazonaws.com execution-role trust + iam:PassRole), a reusable AgentCore project template (agentcore.json + app/<agent>/main.py + a least-privilege execution role) deployed to a Runtime endpoint, governed tools via Gateway, Identity (JWT-only) + Memory + Guardrails, observability & endpoint rollback, and the control-plane/per-agent 4-stack split — each step with validation and the real pitfalls (wrong service principal, iam:PassRole, the >53-layer/non-numeric-USER container, GetWorkloadAccessTokenForUserId escalation, LTM provisioning). Anchored to the AWS AgentCore CLI + runtime-permissions docs; Container-build, code-based-agent variant.
Build an AI Agent Factory on AWS (Bedrock Agents + Terraform)
How to build a thin AI Agent Factory: ownership & IAM boundaries, a reusable Terraform agent-template module (agent + action-group Lambda + scoped service role + Guardrail + alias), a vending pipeline that Prepares → versions → aliases each agent, governance gates, observability & alias-rollback, and the control-plane/template module split — each step with validation and the real pitfalls (the Prepare→alias race, the mandatory Lambda resource-based policy). Anchored to AWS's Terraform agent-lifecycle reference; classic Bedrock Agents variant.
Centralized Ingress — Implementation (AWS, Terraform)
How to build it — the firewall-first edge model from the AWS Multi-VPC whitepaper: ownership & RAM boundaries, the packet-by-packet route-table matrix, state mechanics & failure domains, and the three-module Terraform topology — with validation and pitfalls per phase, and the cross-TGW inspection variant named as the alternative.
No posts match — try a different keyword or clear the filters.