138 practical guides on AWS security, cost, multi-account setups, and infrastructure as code, written from production work.
Want new posts in your inbox? Subscribe to the newsletter.
Search titles, summaries, and tag combinations across all 138 posts.
Filter by topic
138 posts published
Central egress doesn't always save money. Pick an AWS multi-account networking model per traffic path, with failure domains, costs and owners compared.
AWS IPAM stops VPC CIDR overlaps across AWS Organizations: pool design for 3-15 accounts, worked pricing math, a CDK example and adopting existing VPCs.
Accounts queuing? Compare 5 AWS account vending machine options, from Account Factory to IaC, on speed, AWS cost and closure, plus a pull-request example.
Account Factory for Terraform runs on Control Tower; a CDK landing zone runs on Organizations and StackSets. See which fits a Terraform team or a CDK team.
AWS Landing Zone Accelerator and a CDK landing zone are both built with CDK. The real difference is who owns the code. Compare configs, costs, and upgrades.
OrgFormation does have a change-set preview, and the SCP quota just doubled. See how it really compares to a CDK-native landing zone on safety and scale.
How to use AWS Trusted Advisor: the current 2026 support plan pricing, console workflow, API automation, org-wide rollout, and Compute Optimizer comparison.
AWS never shipped a delete-profile command. Here's how to safely delete or remove an AWS CLI profile, clean up SSO and cached credentials, and verify it worked.
Create a new AWS account or invite an existing one, and know exactly what changes for its IAM users, root access, and billing before you click accept.
AWS CDK vs CloudFormation, compared by an AWS consultant: is CFN deprecated, what CDK's bootstrap really costs, and when to still pick plain CloudFormation.
AWS Control Tower gives you a managed console. A CDK landing zone gives you code you can test, review, and roll out in parallel with StackSets. Compare both.
A time-boxed AWS CDK getting started guide: install checks, authentication, bootstrap, and your first deploy in TypeScript or Python, with no side quests.
The 10 findings that appear in almost every AWS Well-Architected Review, with HRI/MRI risk level, how to detect each one, and links to the official AWS docs that close it.
The AWS Well-Architected Tool is free. Here is how to actually use it: workload setup, lenses, profiles, Trusted Advisor, Jira, and the improvement plan.
Most AWS consulting lists rank whoever wrote them first. This guide matches 14 firms to your buyer profile: startup, scale-up, enterprise, or regulated.
Most AWS consulting engagements produce hours billed against a vague scope. Here's what a production-grade engagement delivers and how to tell the difference.
AWS IQ has shut down. A former 5-star IQ seller compares every replacement: AWS Marketplace, APN Partners, LinkedIn, meetups, and the rest.
AWS Well-Architected Framework Security Pillar guide: learn the 7 review domains, what to evaluate first, and how to prepare one workload for review.
AWS Well-Architected Framework pillars explained with real workload examples, trade-offs, and a practical way to decide what to optimize first in each workload.
What is an AWS Well-Architected Review? Learn what it covers, why it is not an audit, what you get, and when CTOs should run one before launch or major change.
AWS Well-Architected Review cost guide: compare free tool access, partner pricing, credits, support plan limits, and remediation costs before you commit.
Learn the AWS Well-Architected Review Process from preparation to remediation: phases, roles, deliverables, HRIs, reports, and follow-up actions.
Your SOC 2 Type II clock starts the day your controls go live, not when you hire an auditor. Learn why your AWS Landing Zone must come first.
AWS operational best practices by OE area: Organize, Prepare, Operate, Evolve. Practical guide with CDK examples and self-assessment checklist. Updated 2026.
All 57 AWS Well-Architected Review questions across 6 pillars, plus the step-by-step process, HRI prioritization, and CDK remediation examples. Updated 2026.
Your AWS bill doubled. Here's exactly what happens during a cost optimization assessment: the phases, deliverables and timeline, and what savings to expect.
Confused about Operational Excellence vs Performance Efficiency? Here's how to tell the difference with real-world scenarios and a practical decision framework.
Outgrown your single AWS account? This practitioner's guide covers when to migrate, the 5-phase roadmap, and mistakes to avoid. Start planning today.
Discover the measurable benefits of AWS Landing Zones: 95%+ faster account provisioning, 60-80% less operational overhead, and continuous compliance. Build your business case.
Learn 6 proven strategies to cut AWS costs by 20-40% using multi-account architecture. Covers volume discounts, Savings Plans, shared VPC, and automation.
Your AWS bill keeps climbing and you want answers. Learn the 6 reasons costs spiral, how to diagnose the cause, and a step-by-step plan to stop it.
Learn exactly what happens during an AWS security review process. Day-by-day timeline, preparation steps, deliverables, and your post-review options.
Learn what SOC 2 auditors expect from your AWS controls. Covers shared responsibility, required controls, evidence collection, common failures, and a 90-day readiness plan.
Stop wasting time on the wrong AWS security partner. Get our 10-point evaluation checklist, discovery call questions, and honest comparison of providers.
The exact checklist we use for paid security reviews. 55+ items covering IAM, network, data, and logging with time estimates and remediation steps.
We've audited 200+ AWS accounts. These 10 security misconfigurations appear in 90% of them. Learn how to detect and fix each issue with CLI commands.
Stop implementing AWS security blindly. Learn the critical IAM, network, data, and monitoring practices that prevent most breaches, with specific configurations.
Learn what an AWS security audit examines, how it differs from reviews and pen tests, and when you need professional help vs DIY. Includes decision framework.
Stop drowning in generic tips. Learn AWS cost optimization through our maturity model: from visibility to FinOps culture. Up to 72% savings with Savings Plans, 40% with Graviton.
Stop wasting time on random AWS cost optimizations. This maturity-based checklist shows exactly where to start with realistic timelines and 15-72% savings.
Learn AWS IAM Identity Center from architecture to implementation. Covers identity sources, permission sets, MFA, CLI integration, and troubleshooting.
Learn what AWS European Sovereign Cloud is, how it works technically, and whether you need it. Complete guide with decision framework for EU data sovereignty.
Master AWS CDK best practices with Projen setup, testing, cdk-nag compliance, GitHub Actions CI/CD, and anti-patterns to avoid.
Compare ClickOps vs IaC on AWS. Learn the 7 risks of manual operations, choose your IaC tool, and get a migration path backed by AWS guidance.
Learn Infrastructure as Code (IaC) fundamentals, compare AWS tools (CloudFormation, CDK, SAM, Terraform), and master best practices with examples.
Pass the AWS CloudOps Engineer Associate SOA-C03 exam with study timelines by experience level, free resources, hands-on labs, and exam day strategies.
Learn what ClickOps is, why AWS identifies manual operations as an anti-pattern, and how to eliminate it using Console-to-Code and AWS-native tools.
AWS CDK vs Terraform 2026 comparison: provisioning speed benchmarks, side-by-side code, CDKTF deprecation guide, and a clear decision framework.
Case study on how NetworkLessons simplified and improved their Operations and reduced their time spend on maintenance by replacing their Kubernetes cluster with AWS ECS Fargate combined with a fully automated AWS CDK environment.
Control Tower is free, but the AWS Config and CloudTrail it turns on are not. See what that costs, what Organizations alone covers, and which one you need.
Tired of Control Tower's ClickOps limits? Compare all 5 AWS-native alternatives (AWS CDK Landing Zone, LZA, CfCT, AFT, and OrgFormation) with a clear recommendation.
Learn best practices for AWS Organizations, Service Control Policies, and using landing zones to scale from 1 to 100+ accounts.
Most AWS breaches start with basic misconfigurations. Learn the root user, IAM, logging, and cost management fundamentals that protect every AWS account.
Set up AWS delegated administrators to protect your management account. Covers which services to delegate, implementation steps, and security best practices.
Enable 8 policy types, 15+ service integrations, and delegated administrators to transform your AWS Organizations setup into production-ready governance that prevents security incidents and compliance failures.
Learn how to design and implement an AWS multi-account strategy that matches your organization size and maturity. From startup to enterprise, discover the right account architecture patterns to improve security, cost control, and operational efficiency.
Build a secure, scalable AWS cloud foundation with this complete guide. Covers Organizations, landing zones, IaC, governance, security, and cost management.
An AWS landing zone is a governed multi-account AWS environment. Learn what it sets up, how it differs from AWS Control Tower, and how to build one.
AWS Enterprise Support costs 10% of your monthly spend with a $15K minimum. But are TAMs worth it, or should you work with AWS Partners instead? Real experiences from AWS practitioners reveal what actually works.
A curated collection of ZSH aliases and custom functions that streamline daily development workflows, from AI-powered Git commits to fuzzy file searching and modern CLI tool replacements.
Practical AWS CLI aliases from my aws-toolbox project that shorten repetitive CloudFormation, EC2, networking and security workflows.
A carefully crafted Powerlevel10k configuration that provides essential git information, system status, and development context without cluttering the prompt.
A performance-optimized ZSH configuration that achieves 30ms startup times while loading 11+ plugins including syntax highlighting, autosuggestions, and intelligent completions.
AWS Professional Services costs $300+ per hour, putting it out of reach for most businesses. Learn about AWS Partner Network alternatives that offer the same expertise at $100-250/hour with 17-67% cost savings.
Learn how to set up automatic preview environments for Next.js apps using SST and GitHub Actions, similar to Vercel's preview URLs but on AWS infrastructure.
Case study detailing how Towards the Cloud partnered with Accolade to build a secure, scalable, and SOC 2 compliant AWS landing zone.
Solve the AWS EC2 error 'You have requested more vCPU capacity than your current vCPU limit' by increasing your service quota.
Resolve the AWS ECS ExecuteCommand error 'an error occurred (invalidparameterexception) when calling the executecommand operation' by checking IAM permissions and enabling ECS Exec.
Resolve the AWS CLI ForbiddenException error when calling GetRoleCredentials in AWS SSO by verifying profile configuration and permission sets.
Fix the AWS CLI error: Missing the following required SSO configuration values: sso_start_url, sso_region, sso_role_name, sso_account_id.
Find AWS Trusted Advisor checks by category, covering cost optimization, performance, security, fault tolerance, service limits, and operational excellence.
In this guide, we'll explore how to list public and private IP Addresses of your EC2 instances using the AWS Command Line Interface (CLI).
Solve the AWS CDK error 'cannot consume a cross reference from stack' by ensuring stacks are in the same environment or properly nested.
Resolve the AWS CDK error 'Found an encoded list token string in a scalar string context' by using Fn::Select instead of array indexing.
Compare Amazon ECS vs EC2: architecture, pricing, security, and when to use each. Includes decision framework and migration guide.
ECS and Fargate work together, not against each other. Learn when to choose EC2 vs Fargate launch types with our decision framework and cost analysis.
Master 3 methods to switch AWS CLI profiles: --profile flag, AWS_PROFILE variable, and default profile editing. Includes platform-specific commands, troubleshooting, and IAM role assumption.
Step-by-step commands to install Python 3 and pip on Amazon Linux 2, Amazon Linux 2023, and Ubuntu EC2 instances. Copy-paste ready.
In this article, you'll learn how you can quickly and securely connect to your Amazon EC2 instance using AWS Session Manager in the AWS Console and AWS CLI.
Check if a file or object exists in an S3 bucket using Boto3's head_object method. Includes single and batch file checking with copy-paste Python code.
Write files and data to Amazon S3 with Python Boto3. Follow examples for uploading local files, writing strings, and saving JSON objects to an S3 bucket.
Learn how to identify your active IAM user or role and list its granted permissions using the AWS CLI with `sts get-caller-identity` and `iam get-account-authorization-details`.
This guide walks you through upgrading AWS CLI v2 to the latest version on Linux, macOS (using Homebrew), and Windows, ensuring optimal performance and security.
Learn how to create an AWS IAM role assumable by multiple principals (e.g., services like EC2 and DynamoDB) using AWS CDK's CompositePrincipal or addPrincipals method.
Learn how to assume an IAM role in AWS using Console GUI, AWS CLI profiles, direct STS commands, and the Granted tool. Complete guide with troubleshooting, cross-account setup, and MFA configuration.
Learn how to create a custom IAM role and assign it to an AWS Lambda function using AWS CDK in TypeScript, including adding extra permissions.
Learn how to create an explicit 'DependsOn' relationship between AWS resources like RDS and EC2 instances using AWS CDK in TypeScript to control deployment order.
Learn what cdk bootstrap creates in your AWS account, how to run it, and fix common errors. Covers multi-account setup and CDK v2 bootstrap template v27.
Configure AWS credentials in Boto3 using environment variables, shared credential files, AWS config, or IAM Identity Center. Includes code examples for each method.
In this how-to guide, we will show you how to find AWS accounts by their Organization Unit (OU) name. This can be particularly useful as it allows you to locate…
Learn how to structure AWS CDK projects from starter to enterprise scale. Covers constructs, stacks, testing, assets, and anti-patterns to avoid.
Learn how to use a Python script with Boto3 to automate the deletion of inactive Amazon ECS task definitions across all AWS regions, keeping your environment tidy.
Run Python Boto3 methods across multiple AWS accounts. Set up AWS profiles, create a cross-account IAM role, and use a Python script to assume roles and make calls.
Learn how to set a CloudWatch Logs Retention Policy for all log groups in an AWS region using Python and Boto3 to manage log data effectively.
Learn how to create a Python script using AWS Boto3 to find and delete all unused Elastic IP (EIP) addresses across all AWS regions to save costs.
Learn how to use a Python Boto3 script to find and delete unused AWS security groups within a single region, improving account hygiene and security.
Use a Python Boto3 script to find unused Amazon EC2 security groups in a single AWS region, helping manage security effectively.
Pass the AWS Developer Associate DVA-C02 exam with customized study plans, service decision frameworks, and 2026-updated exam strategy.
Pass AWS Security Specialty SCS-C03 with our complete 2026 guide. Study plans, domain breakdowns, practice exam strategies, and hands-on labs.
Learn how to deploy and use the AWS Distributed Load Testing solution with Apache JMeter to test your applications, analyze results, and identify bottlenecks.
Task roles let containers call AWS APIs (S3, SNS). Execution roles let ECS agents pull images and push logs. Learn when to use each with IAM examples.
Learn how to trigger or test an Amazon CloudWatch alarm using the AWS CLI `set-alarm-state` command to verify alarm actions like SNS notifications.
Retrieve EC2 instance metadata like instance type, ID, and region using curl, the ec2-metadata tool, or IMDSv2 tokens. Includes IPv4 and IPv6 examples.
Learn how to list all active AWS resources within a specific Amazon VPC using AWS Config Advanced Queries in the AWS Console and AWS CLI.
Learn how to attach or change a security group on a running AWS EC2 instance using the AWS Console and AWS CLI with detailed steps.
AWS CDK is a framework for defining AWS infrastructure in code and deploying it via CloudFormation. How it works, and is it still worth using in 2026?
Learn the steps to set up and securely configure an Amazon S3 bucket using AWS CDK in TypeScript, including encryption and access control.
Learn AWS Service Control Policies with 2025 updates: full IAM language support, practical examples, troubleshooting workflows, and enterprise governance patterns. Includes SCP vs IAM comparison and RCP overview.
Learn the steps to access an Amazon ECS container running on AWS Fargate or EC2 using the 'aws ecs execute-command' in the AWS CLI.
25+ production-ready AWS SCP examples organized by OU (Production, Development, Security, Sandbox, Infrastructure). Copy-paste policies to prevent breaches, cost overruns, and compliance violations. Updated 2026 with Bedrock, RCPs, and modern services.
Find your AWS account ID and account name using the AWS Console or CLI. Quick commands: sts get-caller-identity for account ID, plus the console shortcut.
Learn the AWS CLI commands to empty an S3 bucket (both versioned and non-versioned) and then delete it, including handling potential errors.
Deploy an AWS CloudFormation template through the AWS Console. Upload your template, set stack parameters and tags, review options, and verify the deployment.
Discover the top 10 VS Code extensions for Cloud Engineers, including Docker, AWS Toolkit, Hashicorp Terraform, GitLens, and more to boost productivity.
Boost your JavaScript web development with these 10 must-have VS Code extensions. Includes ESLint, Prettier, GitLens, and more.
Explore 10 VS Code extensions for TypeScript development, including ESLint, Prettier, GitLens, Tailwind CSS IntelliSense, Git Graph, and GitHub Copilot.
Learn AWS Organizations from setup to production governance: SCPs, RCPs, declarative policies, OU design, pricing, and how it works with Control Tower.
Learn what AWS CDK constructs are, understand L1, L2, and L3 construct levels, and master scope, ID, and props with visual diagrams and practical examples.
Learn what an AWS CDK stack is, how it relates to CloudFormation, and master stack lifecycle, properties, nested stacks, and best practices with TypeScript examples.
Replace long-lived AWS access keys with Bitbucket OIDC for secure Pipelines deployments. AWS CDK setup with trust policies, IAM roles, and error fixes.
Set up GitHub OIDC with AWS CDK to eliminate access keys. Step-by-step guide with OidcProviderNative, trust policies, and troubleshooting.
Build a scheduled AWS Fargate task with AWS CDK. Follow the TypeScript examples to create a VPC, configure an ECS cluster, and run containers on a schedule.
Learn how to create an Application Load Balanced Fargate Service using the AWS CDK, including setting up VPC, ECS Cluster, and configuring the Fargate service.
Pass the AWS DevOps Engineer Professional (DOP-C02) exam with our 8-week study plan. Includes domain cheat sheets, resources, exam strategy, and practice tips.
A complete example demonstrating how to share resources, like a VPC, between different AWS CDK stacks within the same CDK application.
Learn how to create IAM roles and a reusable shell script using AWS STS to assume roles cross-account, useful for CI/CD pipelines like AWS CodeBuild.
Pass any AWS certification exam on your first attempt. Study plans, free resources, test-taking strategies, and exam day tips. Updated 2026.
The 10 best VS Code extensions for Python developers: Pylance, Python by Microsoft, Sourcery, and more. Tested and reviewed for code quality and productivity.
Complete guide to installing AWS CDK. Covers prerequisites, Node.js requirements, npm installation, verification, and troubleshooting for all platforms.
Follow this 5-step guide to configure the AWS CLI for use with AWS IAM Identity Center (formerly AWS SSO) for secure and easy access.
Use the CDK Construct Snippets VS Code extension to autocomplete AWS CDK L1 constructs and their properties, speeding up development.
Discover 1,000+ free AWS learning resources. Get personalized learning paths, hands-on labs, and certification prep. Updated for 2026.
Speed up AWS CloudFormation template creation with the CloudFormation Snippets VS Code extension for autocompleting resources and properties.
Learn how to integrate cfn-lint into your AWS CodePipeline using AWS CodeBuild to automatically validate CloudFormation templates and enforce standards.
Pass the AWS Solutions Architect Associate SAA-C03 exam on your first try. Study plans by experience level, hands-on labs, practice exams, and exam day tips.
Pass AWS Cloud Practitioner CLF-C02 with study plans by experience level, free resources, service priority matrix, and exam strategies. Updated 2026.
Harden WordPress on Amazon Lightsail with Cloudflare. Configure SSH access, end-to-end SSL encryption, security headers, and firewall rules to protect wp-admin.
Boost your AWS CloudFormation productivity with these essential VS Code extensions and CLI tools. Speed up development and validation.
Get real-world insights from building production AWS infrastructure at scale.