# Fernando F. Azevedo: Full LLM Content Map This file lists crawl-friendly HTML and Markdown URLs for the portfolio, blog and open-source repository guides. ## Primary Pages - Home: https://fernando.moretes.com/ - Profile: https://fernando.moretes.com/profile - Resume: https://fernando.moretes.com/resume - Architecture: https://fernando.moretes.com/architecture - Architecture Markdown playbook: https://fernando.moretes.com/architecture/playbook.md - Blog: https://fernando.moretes.com/blog - Blog Markdown index: https://fernando.moretes.com/blog/index.md - Architecture Studies: https://fernando.moretes.com/studies - IA Builder: https://fernando.moretes.com/ia-builder - Open Source: https://fernando.moretes.com/open-source - Open Source Markdown index: https://fernando.moretes.com/open-source/index.md - E-books: https://fernando.moretes.com/ebooks - E-books Markdown index: https://fernando.moretes.com/ebooks/index.md - Podcast: https://fernando.moretes.com/podcast - Legal: https://fernando.moretes.com/legal ## Blog Articles ### Private CA logs every issuance: a field guide to IssueCertificateDetails Since October 5, 2026 AWS Private CA emits an IssueCertificateDetails event to CloudTrail for every issuance attempt, with the full TBS certificate, the issuing CA, the requester and the failure reason. It closes an audit gap I used to work around with audit reports plus GetCertificate. These field notes say what to switch on tomorrow, what the event does not solve, and where cost and privacy law come in. - HTML: https://fernando.moretes.com/blog/private-ca-registra-cada-emissao-guia-de-campo-do - Markdown EN: https://fernando.moretes.com/blog/private-ca-registra-cada-emissao-guia-de-campo-do/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/private-ca-registra-cada-emissao-guia-de-campo-do/article.md?lang=pt - Category: AWS & Cloud - Tags: aws-private-ca, cloudtrail, pki, compliance, security, eventbridge, athena, finops ### AI Builder in Practice: What It Is, What Changes, and How I Apply It At AWS Summit São Paulo 2026, AWS summed up the new practitioner profile as "the team decides at each phase; the AI executes." This site runs that way. Here I explain what an AI Builder is, what they do all day (define, orchestrate, validate), how AI-DLC and Kiro organize that into gates, and where my own pipeline taught me that validating is the real work. - HTML: https://fernando.moretes.com/blog/ia-builder-na-pratica-os-agentes-executam-eu-decido-o-que-vai-ao-ar-aws-summit-s - Markdown EN: https://fernando.moretes.com/blog/ia-builder-na-pratica-os-agentes-executam-eu-decido-o-que-vai-ao-ar-aws-summit-s/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ia-builder-na-pratica-os-agentes-executam-eu-decido-o-que-vai-ao-ar-aws-summit-s/article.md?lang=pt - Category: AI & Agents - Tags: ia-builder, ai-dlc, kiro, aws-summit, agentes-de-ia, claude-code, amazon-bedrock ### Security Hub remediation plans: root-cause remediation, dissected On October 1, 2026, Security Hub gained remediation plans: instead of a queue of findings, one plan per root cause, with an impact assessment and instructions in CLI, Terraform, CloudFormation, Python, and CDK. I dissect the root-cause remediation pattern, the problem it solves, its anatomy, when to use it and when not, and the detail that deserves the most scrutiny: AI agents consuming plans through the API. - HTML: https://fernando.moretes.com/blog/remediation-plans-no-security-hub-remediacao-por-causa-raiz-dissecada - Markdown EN: https://fernando.moretes.com/blog/remediation-plans-no-security-hub-remediacao-por-causa-raiz-dissecada/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/remediation-plans-no-security-hub-remediacao-por-causa-raiz-dissecada/article.md?lang=pt - Category: Security & Resilience - Tags: security-hub, exposure-management, remediation, root-cause, iam, ai-agents, governance, finops ### Multi-Region training on HyperPod: how Qumulo's cache hides 60 ms AWS and Qumulo published a training validation with compute in `us-west-2` and the dataset in `us-east-2`, 60 ms of RTT apart, and the remote cluster matched the co-located one after 100–150 warmup batches. I dug into the mechanism: metadata replicated in seconds, predictive prefetch over sequential 4 KB reads, and a network path with very concrete limits. The result is real, but it holds under specific conditions, and those conditions are what this article takes apart. - HTML: https://fernando.moretes.com/blog/treino-multi-region-no-hyperpod-como-o-cache-da-qumulo-esconde-60-ms - Markdown EN: https://fernando.moretes.com/blog/treino-multi-region-no-hyperpod-como-o-cache-da-qumulo-esconde-60-ms/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/treino-multi-region-no-hyperpod-como-o-cache-da-qumulo-esconde-60-ms/article.md?lang=pt - Category: AI & Agents - Tags: sagemaker-hyperpod, multi-region, treinamento-distribuido, storage, networking, finops, qumulo ### Notebook off the cluster: migrating to Spark Connect on EMR on EKS On 24 Sep 2026 Amazon EMR on EKS gained interactive sessions through Spark Connect: the Spark driver becomes a gRPC server on your EKS cluster and the PySpark client stays in the IDE where the code is written. I treated it as a migration, not a feature, and the hard part is not connecting, it is what the endpoint drags along in networking, IAM and idle cost. - HTML: https://fernando.moretes.com/blog/notebook-fora-do-cluster-migrar-para-spark-connect-no-emr-on-eks - Markdown EN: https://fernando.moretes.com/blog/notebook-fora-do-cluster-migrar-para-spark-connect-no-emr-on-eks/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/notebook-fora-do-cluster-migrar-para-spark-connect-no-emr-on-eks/article.md?lang=pt - Category: AWS & Cloud - Tags: emr-on-eks, spark-connect, kubernetes, data-platform, iam, finops, pyspark ### Four engineering patterns that separate multi-agent from prompt chains Google published the four engineering patterns that showed up in the AI Agents Challenge winners. None of them is about the model: they are tool interfaces, async messaging, structural validation and cheap routing before inference. I review each one with what changes when you carry it to AgentCore, EventBridge and Bedrock, and where the challenge prototype does not survive production. - HTML: https://fernando.moretes.com/blog/quatro-padroes-de-engenharia-que-separam-multiagente-de-prompt-chain - Markdown EN: https://fernando.moretes.com/blog/quatro-padroes-de-engenharia-que-separam-multiagente-de-prompt-chain/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/quatro-padroes-de-engenharia-que-separam-multiagente-de-prompt-chain/article.md?lang=pt - Category: AI & Agents - Tags: ai-agents, mcp, event-driven, bedrock, agentcore, eventbridge, finops, resilience ### Beanstalk Cluster Mode: the postmortem I wrote before the incident Elastic Beanstalk gained a mode where environments with the same subnet set share a service-operated EKS cluster. That changes the blast radius: one manual tweak on the cluster leaves every environment on it unable to deploy until someone reverts it. I wrote the postmortem for that incident before it happened, using only documented behavior, and list what to configure on day zero. - HTML: https://fernando.moretes.com/blog/beanstalk-cluster-mode-o-postmortem-que-escrevi-antes-do-incidente - Markdown EN: https://fernando.moretes.com/blog/beanstalk-cluster-mode-o-postmortem-que-escrevi-antes-do-incidente/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/beanstalk-cluster-mode-o-postmortem-que-escrevi-antes-do-incidente/article.md?lang=pt - Category: AWS & Cloud - Tags: elastic-beanstalk, eks, multi-tenancy, blast-radius, postmortem, finops, platform-engineering ### Training and inference on one GPU fleet: four ways to share 10,000 accelerators China Merchants Bank won the CNCF End User Case Study Contest by putting training, fine-tuning and inference on a single Kubernetes control plane over nearly 10,000 heterogeneous accelerators: average utilization from 35% to over 60% and cost per million tokens cut by more than 60%. I break down what makes that number happen, quota-aware queueing, metric-driven autoscaling, GPU virtualization and data caching, and compare four ways to reproduce it on AWS, with the decision matrix I would use at a bank. - HTML: https://fernando.moretes.com/blog/treino-e-inferencia-na-mesma-gpu-quatro-formas-de-partilhar-10-mil-ace - Markdown EN: https://fernando.moretes.com/blog/treino-e-inferencia-na-mesma-gpu-quatro-formas-de-partilhar-10-mil-ace/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/treino-e-inferencia-na-mesma-gpu-quatro-formas-de-partilhar-10-mil-ace/article.md?lang=pt - Category: AI & Agents - Tags: kubernetes, eks, gpu, kueue, keda, finops, sagemaker-hyperpod, ai-platform ### LLM cold starts on HyperPod: from 27 minutes to seconds with model caching SageMaker HyperPod now pre-loads model weights onto local NVMe and container images onto nodes, with roughly 60% faster scale-out on 57–145 GB models. I walk through migrating a document-analysis endpoint step by step, from the 27-minute time-to-first-token baseline to rewriting the autoscaling policy that only existed to live with the cold start. - HTML: https://fernando.moretes.com/blog/cold-start-de-llm-no-hyperpod-de-27-minutos-a-segundos-com-model-cachi-amazon-sagem - Markdown EN: https://fernando.moretes.com/blog/cold-start-de-llm-no-hyperpod-de-27-minutos-a-segundos-com-model-cachi-amazon-sagem/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/cold-start-de-llm-no-hyperpod-de-27-minutos-a-segundos-com-model-cachi-amazon-sagem/article.md?lang=pt - Category: AI & Agents - Tags: SageMaker HyperPod, LLM inference, cold start, KEDA, Karpenter, NVMe, EKS, autoscaling ### MediaLive without timecode: what Video Aligned Locking changes in redundancy MediaLive can now synchronize pipelines by visual frame signature, with no dependency on embedded timecode, precisely the missing piece for field SRT/RTMP sources and for single-pipeline channels linked across regions. I dissect the pattern: the problem it solves, the anatomy of locking modes and methods, the frame-rate and input rules that silently break sync, and the three metrics that need alarms before this goes to production. - HTML: https://fernando.moretes.com/blog/medialive-sem-timecode-o-que-o-video-aligned-locking-muda-na-redundanc-aws-elementa - Markdown EN: https://fernando.moretes.com/blog/medialive-sem-timecode-o-que-o-video-aligned-locking-muda-na-redundanc-aws-elementa/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/medialive-sem-timecode-o-que-o-video-aligned-locking-muda-na-redundanc-aws-elementa/article.md?lang=pt - Category: Data Platforms - Tags: MediaLive, live-streaming, pipeline-locking, multi-region, resilience, observability, media-services, SRT ### Lambda recursive loops: four guardrails compared in the Sovereign Cloud Lambda recursive loop detection reached the European Sovereign Cloud on September 10, 2026. It cuts the chain at ~16 invocations, but only across Lambda, SQS, SNS and S3, and the alert can take 3.5 hours. I compare four guardrails, native detection, structural separation, a concurrency ceiling and an application-level hop counter, and say when each one is enough. - HTML: https://fernando.moretes.com/blog/loop-recursivo-no-lambda-quatro-guardrails-comparados-no-sovereign-clo-aws-lambda-r - Markdown EN: https://fernando.moretes.com/blog/loop-recursivo-no-lambda-quatro-guardrails-comparados-no-sovereign-clo-aws-lambda-r/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/loop-recursivo-no-lambda-quatro-guardrails-comparados-no-sovereign-clo-aws-lambda-r/article.md?lang=pt - Category: AWS & Cloud - Tags: AWS Lambda, European Sovereign Cloud, event-driven, FinOps, SQS, S3, guardrails, serverless ### Workload-type capacity in Amazon Connect: what actually changes Amazon Connect now lets you set concurrency per workload type inside the Task and Email channels instead of per channel. The operational gain is real on high-variance queues, disputes, KYC, regulated back office. The price is a new taxonomy to govern and a failure mode that does not shout: a contact whose workload type has no matching row in the routing profile stays queued forever. - HTML: https://fernando.moretes.com/blog/capacidade-por-tipo-de-trabalho-no-amazon-connect-o-que-muda-de-fato-amazon-conne - Markdown EN: https://fernando.moretes.com/blog/capacidade-por-tipo-de-trabalho-no-amazon-connect-o-que-muda-de-fato-amazon-conne/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/capacidade-por-tipo-de-trabalho-no-amazon-connect-o-que-muda-de-fato-amazon-conne/article.md?lang=pt - Category: Data Platforms - Tags: amazon-connect, routing, capacity-planning, contact-center, observability, iac, aws ### GPT-6 Astra on Bedrock: the endpoint decides what you audit GPT-6 Astra reached GA on Amazon Bedrock on September 8, 2026 with a 1,050,000-token context window and an architectural fork: the model is served by `bedrock-runtime` and by `bedrock-mantle`, and each endpoint withholds something the other gives. I break down what each path costs in money, in quota and in auditable trail, and why, for regulated workloads in Brazil, the conversation starts and ends at data residency. - HTML: https://fernando.moretes.com/blog/gpt-6-astra-no-bedrock-o-endpoint-decide-o-que-voce-audita-openai-gpt-6 - Markdown EN: https://fernando.moretes.com/blog/gpt-6-astra-no-bedrock-o-endpoint-decide-o-que-voce-audita-openai-gpt-6/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/gpt-6-astra-no-bedrock-o-endpoint-decide-o-que-voce-audita-openai-gpt-6/article.md?lang=pt - Category: AI & Agents - Tags: amazon-bedrock, openai, gpt-6-astra, finops, governanca, cross-region-inference, prompt-caching, lgpd ### Fable 5.1 on Bedrock: data retention is now an architecture decision Claude Fable 5.1 landed on Bedrock on September 1, 2026 with a 1M-token context window and a condition no prior Anthropic model carried: you must explicitly authorize retention of prompts and outputs for up to 30 days inside the AWS boundary. This is not a consent checkbox, it is an account-scoped setting with organizational blast radius, and it collides head-on with the zero-data-retention SCP most regulated environments already have written. - HTML: https://fernando.moretes.com/blog/fable-5-1-no-bedrock-retencao-de-dados-virou-decisao-de-arquitetura-aws-weekly-r - Markdown EN: https://fernando.moretes.com/blog/fable-5-1-no-bedrock-retencao-de-dados-virou-decisao-de-arquitetura-aws-weekly-r/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/fable-5-1-no-bedrock-retencao-de-dados-virou-decisao-de-arquitetura-aws-weekly-r/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, anthropic, governance, data-residency, iam, scp, finops, llmops ### ECS Early Success Criteria: where your deployment rollback ends On September 4, 2026, Amazon ECS started letting you declare when a rolling deployment is successful, using a healthyPercent over the desired count. This is not a faster-deploy button, it is the definition of where the circuit breaker and alarm-based rollback stop protecting you. This briefing covers the arithmetic of the parameter, the two source-revision cleanup modes, and what your dashboard starts hiding. - HTML: https://fernando.moretes.com/blog/ecs-early-success-criteria-onde-termina-o-rollback-do-seu-deploy-amazon-ecs-i - Markdown EN: https://fernando.moretes.com/blog/ecs-early-success-criteria-onde-termina-o-rollback-do-seu-deploy-amazon-ecs-i/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ecs-early-success-criteria-onde-termina-o-rollback-do-seu-deploy-amazon-ecs-i/article.md?lang=pt - Category: AWS & Cloud - Tags: ecs, deployments, ci-cd, reliability, containers, sre, aws ### RAG on ServiceNow: the connector that erases user criteria Amazon Bedrock Managed Knowledge Base got a native ServiceNow connector on September 4, 2026, and it removes weeks of hand-rolled pipeline. It also tells you to use a service account with knowledge_admin, which bypasses per-knowledge-base user criteria, and the connector ingests no document-level ACL. This is the retro of the pilot where those two lines of documentation met. - HTML: https://fernando.moretes.com/blog/rag-sobre-servicenow-o-conector-que-apaga-o-user-criteria-amazon-bedro - Markdown EN: https://fernando.moretes.com/blog/rag-sobre-servicenow-o-conector-que-apaga-o-user-criteria-amazon-bedro/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/rag-sobre-servicenow-o-conector-que-apaga-o-user-criteria-amazon-bedro/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, rag, servicenow, seguranca, iam, knowledge-base, governanca, finops ### 3LO in Bedrock Managed KB: 5-minute setup, 1 irreversible decision On September 4, 2026 AWS shipped user-managed setup (3LO) for SharePoint, OneDrive and Confluence in Amazon Bedrock Managed Knowledge Base: you sign in with your own account and the data source is live in minutes. What the docs say in fine print is that this path does not support document-level access control, and that the ACL flag cannot be changed after CreateDataSource. This is the story of the migration that forces, from a 3LO prototype to a production knowledge base on ENTRA_ID_APP_ONLY, certificate and userContext. - HTML: https://fernando.moretes.com/blog/3lo-no-bedrock-managed-kb-5-minutos-de-setup-1-decisao-irreversivel-amazon-bedro - Markdown EN: https://fernando.moretes.com/blog/3lo-no-bedrock-managed-kb-5-minutos-de-setup-1-decisao-irreversivel-amazon-bedro/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/3lo-no-bedrock-managed-kb-5-minutos-de-setup-1-decisao-irreversivel-amazon-bedro/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, rag, iam, sharepoint, confluence, governance, oauth ### AMIs with a contract: anatomy of EC2's new instance-type block On September 4, 2026 EC2 started accepting an `InstanceTypeSpecification` on an AMI: two lists, evaluated at `RunInstances`, that block launches on incompatible instance types. The pattern moves compatibility from the caller to the artifact, and it ships with a trap most teams will only find the hard way: the specification matches strings, not hardware capabilities. - HTML: https://fernando.moretes.com/blog/ami-com-contrato-anatomia-do-novo-bloqueio-de-tipos-no-ec2-amazon-ec2-n - Markdown EN: https://fernando.moretes.com/blog/ami-com-contrato-anatomia-do-novo-bloqueio-de-tipos-no-ec2-amazon-ec2-n/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ami-com-contrato-anatomia-do-novo-bloqueio-de-tipos-no-ec2-amazon-ec2-n/article.md?lang=pt - Category: AWS & Cloud - Tags: EC2, AMI, golden image, Auto Scaling, Graviton, Spot, governance, FinOps ### Critical or non-critical: the failure contract of ECS daemons On September 3, 2026 AWS started letting you declare an ECS Managed Daemon as non-critical, turning a decision that used to be implicit into a versioned parameter. What is at stake is not the daemon: it is the failure contract between a cross-cutting agent and the instance hosting it. This teardown dissects the anatomy of the pattern, the decision rule I use to classify each agent, and what you pay, in churn, in blind spots and in dollars, for classifying it wrong. - HTML: https://fernando.moretes.com/blog/daemon-critico-ou-nao-critico-o-contrato-de-falha-do-ecs-amazon-ecs-m - Markdown EN: https://fernando.moretes.com/blog/daemon-critico-ou-nao-critico-o-contrato-de-falha-do-ecs-amazon-ecs-m/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/daemon-critico-ou-nao-critico-o-contrato-de-falha-do-ecs-amazon-ecs-m/article.md?lang=pt - Category: AWS & Cloud - Tags: ECS, Managed Instances, containers, reliability, observability, FinOps, Well-Architected ### SnapStart on containers: the bake-off against provisioned concurrency AWS enabled SnapStart for functions packaged as container images, promising sub-second startup on artifacts of up to 10 GB. I put it head-to-head with provisioned concurrency, with .zip packaging and with an always-on Fargate service, using published prices and documented limits. The conclusion is not about latency: it is about where your pipeline starts paying rent. - HTML: https://fernando.moretes.com/blog/snapstart-em-container-o-bake-off-contra-concorrencia-provisionada-aws-lambda-n - Markdown EN: https://fernando.moretes.com/blog/snapstart-em-container-o-bake-off-contra-concorrencia-provisionada-aws-lambda-n/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/snapstart-em-container-o-bake-off-contra-concorrencia-provisionada-aws-lambda-n/article.md?lang=pt - Category: AWS & Cloud - Tags: aws-lambda, snapstart, serverless, cold-start, finops, container-images, observability ### Apps in Amazon Quick vs. App Studio vs. a custom build On September 1, 2026 AWS made natural-language app building generally available inside Amazon Quick. The architecture question is not whether it works, it is which of four routes still holds up once the app becomes part of the monthly close. I compare seat vs. user-hour pricing, identity propagation and exit cost. - HTML: https://fernando.moretes.com/blog/apps-no-amazon-quick-vs-app-studio-vs-build-proprio-amazon-quick - Markdown EN: https://fernando.moretes.com/blog/apps-no-amazon-quick-vs-app-studio-vs-build-proprio-amazon-quick/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/apps-no-amazon-quick-vs-app-studio-vs-build-proprio-amazon-quick/article.md?lang=pt - Category: AWS & Cloud - Tags: amazon-quick, aws-app-studio, low-code, finops, governance, identity, architecture ### Claude Fable 5.1 on AWS: the model that demands an immutable history Fable 5.1 landed on Bedrock on September 1, 2026 with the same input and output price as Fable 5, but cache reads at a quarter of the cost. What the announcement doesn't say is that it trades orchestration flexibility for reasoning quality: forced tool_choice is gone, and editing history is now an error. I reviewed what that means for anyone running long-horizon agents inside the AWS perimeter. - HTML: https://fernando.moretes.com/blog/claude-fable-5-1-na-aws-o-modelo-que-exige-historico-imutavel-claude-fable - Markdown EN: https://fernando.moretes.com/blog/claude-fable-5-1-na-aws-o-modelo-que-exige-historico-imutavel-claude-fable/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/claude-fable-5-1-na-aws-o-modelo-que-exige-historico-imutavel-claude-fable/article.md?lang=pt - Category: AI & Agents - Tags: amazon-bedrock, claude, agentes, finops, llmops, governanca, aws ### Redshift and Iceberg v3: field notes for mutable lakes Amazon Redshift support for Apache Iceberg v3, announced on August 31, 2026, changes the conversation about mutable data lakes. I would treat default values, row lineage, and deletion vectors as operational primitives, not just table-format features. - HTML: https://fernando.moretes.com/blog/redshift-e-iceberg-v3-notas-de-campo-para-lakes-mutaveis-amazon-redsh - Markdown EN: https://fernando.moretes.com/blog/redshift-e-iceberg-v3-notas-de-campo-para-lakes-mutaveis-amazon-redsh/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/redshift-e-iceberg-v3-notas-de-campo-para-lakes-mutaveis-amazon-redsh/article.md?lang=pt - Category: Data Platforms - Tags: redshift, iceberg, data-lake, cdc, governance, aws ### Active-active Amazon Connect: the resilience lesson The August 31, 2026 launch changes the operating model: two Amazon Connect regions can actively serve contacts and agents with unified operational visibility. I read it less as a failover feature and more as a correction to a classic weakness: the standby environment nobody exercises until the day it is needed. - HTML: https://fernando.moretes.com/blog/amazon-connect-ativo-ativo-a-licao-de-resiliencia-amazon-conne - Markdown EN: https://fernando.moretes.com/blog/amazon-connect-ativo-ativo-a-licao-de-resiliencia-amazon-conne/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/amazon-connect-ativo-ativo-a-licao-de-resiliencia-amazon-conne/article.md?lang=pt - Category: Security & Resilience - Tags: Amazon Connect, Resilience, DR, Contact Center, Well-Architected, Operations, Financial Services ### Migrating Time Series to Timestream for InfluxDB The August 31, 2026 regional expansion of Amazon Timestream for InfluxDB changes the adoption conversation for teams that need operational data closer to users and local rules. I would treat it as a controlled modernization opportunity, not as a simple endpoint swap. - HTML: https://fernando.moretes.com/blog/migrar-series-temporais-para-timestream-for-influxdb-amazon-times - Markdown EN: https://fernando.moretes.com/blog/migrar-series-temporais-para-timestream-for-influxdb-amazon-times/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/migrar-series-temporais-para-timestream-for-influxdb-amazon-times/article.md?lang=pt - Category: Solution Architecture - Tags: AWS, Timestream, InfluxDB, Migration, Observability, FinOps, Multi-AZ, Time Series ### Private Redshift SSO with EVR: a pattern teardown I see this launch as an important architectural correction: authentication now follows the same private path as analytical data. For regulated environments, the gain is not only SSO; it is removing a network exception that is hard to defend in audit. - HTML: https://fernando.moretes.com/blog/redshift-sso-privado-com-evr-padrao-de-teardown-amazon-redsh - Markdown EN: https://fernando.moretes.com/blog/redshift-sso-privado-com-evr-padrao-de-teardown-amazon-redsh/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/redshift-sso-privado-com-evr-padrao-de-teardown-amazon-redsh/article.md?lang=pt - Category: Data Platforms - Tags: Redshift, IAM Identity Center, PrivateLink, EVR, Analytics, Zero Trust, Data Governance, AWS ### MediaTailor Analytics: console, BI, or lakehouse? The AWS Elemental MediaTailor analytics dashboard changes the first line of investigation for publishers running SSAI across multiple regions. I see it as an excellent operational layer, but not an automatic replacement for BI, financial reconciliation, or engineering observability. - HTML: https://fernando.moretes.com/blog/mediatailor-analytics-console-bi-ou-lakehouse-aws-elementa - Markdown EN: https://fernando.moretes.com/blog/mediatailor-analytics-console-bi-ou-lakehouse-aws-elementa/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/mediatailor-analytics-console-bi-ou-lakehouse-aws-elementa/article.md?lang=pt - Category: Data Platforms - Tags: AWS, MediaTailor, CloudWatch, SSAI, observability, streaming, adtech, Well-Architected ### PRM by User Agent: better attribution, governance still required The Partner Revenue Measurement User Agent expansion is small to implement and meaningful for the economic visibility of SaaS and ISV solutions on AWS. I like the direction, but I would treat it as attribution telemetry, not as a primary financial system. - HTML: https://fernando.moretes.com/blog/prm-por-user-agent-atribuicao-melhor-governanca-ainda-necessaria-partner-reve - Markdown EN: https://fernando.moretes.com/blog/prm-por-user-agent-atribuicao-melhor-governanca-ainda-necessaria-partner-reve/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/prm-por-user-agent-atribuicao-melhor-governanca-ainda-necessaria-partner-reve/article.md?lang=pt - Category: AI & Agents - Tags: AWS, Partner Revenue Measurement, CloudTrail, Marketplace, FinOps, ISV, Governance ### DocumentDB 8.0: direct MVU reduces risk, not migration work Direct major version upgrade support to Amazon DocumentDB 8.0 is an important improvement for teams still carrying 3.6 or 4.0 clusters. I would treat it as fewer steps and less exposure, not as permission to skip rehearsal, compatibility testing, and rollback planning. - HTML: https://fernando.moretes.com/blog/documentdb-8-0-mvu-direto-reduz-risco-nao-elimina-migracao-amazon-docum - Markdown EN: https://fernando.moretes.com/blog/documentdb-8-0-mvu-direto-reduz-risco-nao-elimina-migracao-amazon-docum/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/documentdb-8-0-mvu-direto-reduz-risco-nao-elimina-migracao-amazon-docum/article.md?lang=pt - Category: AWS & Cloud - Tags: AWS, DocumentDB, MongoDB, Databases, Modernization, Reliability, Cost, Security ### MWAA with Airflow 3.3.1: state, language, and operational discipline I see Amazon MWAA support for Apache Airflow 3.3.1 as an important evolution for pipelines that no longer fit a purely stateless model. The real gain is durable state, asset partitioning, and better operational ergonomics; the risk is treating experimental capabilities as a mature enterprise platform too early. - HTML: https://fernando.moretes.com/blog/mwaa-com-airflow-3-3-1-estado-linguagem-e-disciplina-operacional-amazon-mwaa- - Markdown EN: https://fernando.moretes.com/blog/mwaa-com-airflow-3-3-1-estado-linguagem-e-disciplina-operacional-amazon-mwaa-/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/mwaa-com-airflow-3-3-1-estado-linguagem-e-disciplina-operacional-amazon-mwaa-/article.md?lang=pt - Category: AWS & Cloud - Tags: AWS, MWAA, Airflow 3.3, Data Platform, Orchestration, FinOps, Reliability, Governance ### Amazon Connect compact mode: operational density with caution Compact mode in Amazon Connect Customer dashboards looks small, but it touches a central point in critical operations: reducing the time between anomaly, perception, and action. I see it as a useful operational cockpit improvement, as long as it does not become a substitute for alerts, SLOs, automation, and careful metric design. - HTML: https://fernando.moretes.com/blog/amazon-connect-compact-mode-densidade-operacional-com-cautela-amazon-conne - Markdown EN: https://fernando.moretes.com/blog/amazon-connect-compact-mode-densidade-operacional-com-cautela-amazon-conne/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/amazon-connect-compact-mode-densidade-operacional-com-cautela-amazon-conne/article.md?lang=pt - Category: Data Platforms - Tags: Amazon Connect, Contact Center, Observability, Operations, Well-Architected, FinOps, CX, Dashboards ### CloudWatch Alarm Warm-Up: Ending Startup Noise in CI/CD Pipelines CloudWatch now supports warm-up periods for alarms, solving a classic operational noise problem in automated deployments. The feature looks simple, but it carries serious implications for SLOs, on-call fatigue, and pipeline design in financial-grade environments. In this article, I analyze the mechanism, the real trade-offs, and how to integrate this responsibly into production stacks. - HTML: https://fernando.moretes.com/blog/cloudwatch-alarm-warm-up-fim-do-ruido-de-startup-em-pipelines-ci-cd-amazon-cloud - Markdown EN: https://fernando.moretes.com/blog/cloudwatch-alarm-warm-up-fim-do-ruido-de-startup-em-pipelines-ci-cd-amazon-cloud/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/cloudwatch-alarm-warm-up-fim-do-ruido-de-startup-em-pipelines-ci-cd-amazon-cloud/article.md?lang=pt - Category: AWS & Cloud - Tags: cloudwatch, observability, alarms, ci-cd, sre, finops, aws, on-call ### R8i vs R8i-flex: Anatomy of a Memory-Optimized Instance Decision The arrival of R8i and R8i-flex instances in the Europe (Milan) region in August 2026 completes a European expansion that started in Paris and continued through Stockholm and Zurich. More than a regional availability announcement, this move exposes a relevant architectural pattern: the bifurcation between continuous high-performance instances (R8i) and instances optimized for variable-utilization workloads (R8i-flex). Understanding when and why to choose each path is what separates a mature infrastructure decision from expensive over-provisioning. - HTML: https://fernando.moretes.com/blog/r8i-vs-r8i-flex-anatomia-de-uma-decisao-de-instancia-memory-optimized-amazon-ec2-r - Markdown EN: https://fernando.moretes.com/blog/r8i-vs-r8i-flex-anatomia-de-uma-decisao-de-instancia-memory-optimized-amazon-ec2-r/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/r8i-vs-r8i-flex-anatomia-de-uma-decisao-de-instancia-memory-optimized-amazon-ec2-r/article.md?lang=pt - Category: AWS & Cloud - Tags: ec2, memory-optimized, r8i, r8i-flex, financial-grade, sap, postgresql, instance-selection ### AWS Network Firewall as Forward Proxy: Technical Review of the Preview AWS has reintroduced forward proxy as a native functionality of Network Firewall, unifying security policies between transparent and explicit proxy modes under a single resource. This review examines what changed from the November 2025 preview, where the functionality genuinely adds value in financial-grade environments, and where operational risks still warrant caution. - HTML: https://fernando.moretes.com/blog/aws-network-firewall-como-forward-proxy-analise-tecnica-do-preview-preview-anno - Markdown EN: https://fernando.moretes.com/blog/aws-network-firewall-como-forward-proxy-analise-tecnica-do-preview-preview-anno/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aws-network-firewall-como-forward-proxy-analise-tecnica-do-preview-preview-anno/article.md?lang=pt - Category: AWS & Cloud - Tags: network-firewall, forward-proxy, egress-security, zero-trust, eks, financial-grade, aws-security, no-source-preservation ### AWS Transform Continuous Modernization: A Deep Technical Analysis AWS Transform Continuous Modernization reached general availability in August 2026, bringing autonomous technical debt analysis and remediation across code repositories at enterprise scale. In this article I go beyond the announcement and examine the execution mechanism, real failure modes, and the trade-offs every platform team needs to understand before connecting their production repositories. - HTML: https://fernando.moretes.com/blog/aws-transform-continuous-modernization-analise-tecnica-profunda-aws-transfor - Markdown EN: https://fernando.moretes.com/blog/aws-transform-continuous-modernization-analise-tecnica-profunda-aws-transfor/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aws-transform-continuous-modernization-analise-tecnica-profunda-aws-transfor/article.md?lang=pt - Category: Solution Architecture - Tags: aws-transform, technical-debt, agentic-ai, devops, modernization, security, bedrock, platform-engineering ### Aurora DSQL Multi-Region: Field Notes for Financial-Grade Systems Aurora DSQL's expansion to Stockholm, Spain, Mumbai, and Singapore in July 2026 brings multi-region strong consistency within reach of financial architectures across Europe and Asia-Pacific. In this article, I analyze the real trade-offs of adopting distributed active-active SQL, the patterns that work, and the anti-patterns that will cost you dearly in production. - HTML: https://fernando.moretes.com/blog/aurora-dsql-multi-regiao-notas-de-campo-para-sistemas-financeiros-amazon-auror - Markdown EN: https://fernando.moretes.com/blog/aurora-dsql-multi-regiao-notas-de-campo-para-sistemas-financeiros-amazon-auror/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aurora-dsql-multi-regiao-notas-de-campo-para-sistemas-financeiros-amazon-auror/article.md?lang=pt - Category: AWS & Cloud - Tags: aurora-dsql, multi-region, distributed-sql, financial-grade, active-active, consistency, serverless-db, aws-well-architected ### Aurora DSQL Multi-Region: What Changes for Financial-Grade Architectures Amazon expanded Aurora DSQL multi-Region clusters to four additional Regions in July 2026, bringing the total to 16 Regions with active-active write support across both sides of a peered pair. For financial systems architects, this is not merely a geographic expansion, it is a fundamental shift in the resiliency model available without managing manual replication or accepting eventual consistency. In this briefing, I analyze what this signal means for high-availability platform design, where the trade-offs actually live, and how to position this technology within a data portfolio. - HTML: https://fernando.moretes.com/blog/aurora-dsql-multi-region-o-que-muda-para-arquiteturas-financeiras-amazon-auror - Markdown EN: https://fernando.moretes.com/blog/aurora-dsql-multi-region-o-que-muda-para-arquiteturas-financeiras-amazon-auror/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aurora-dsql-multi-region-o-que-muda-para-arquiteturas-financeiras-amazon-auror/article.md?lang=pt - Category: AWS & Cloud - Tags: aurora-dsql, multi-region, distributed-sql, financial-grade, active-active, strong-consistency, serverless-database, resilience ### Aurora DSQL Multi-Region: A Resilience Retro for Financial-Grade Systems Aurora DSQL's expansion to Stockholm, Spain, Mumbai, and Singapore in July 2026 is not merely a regional availability announcement, it signals the maturity of a distributed database primitive that fundamentally changes the resilience calculus for financial-grade systems. In this retro, I analyze what this active-active topology with strong consistency actually means in practice, where teams typically go wrong during adoption, and which design changes must follow. - HTML: https://fernando.moretes.com/blog/aurora-dsql-multi-regiao-retro-de-resiliencia-em-sistemas-financeiros-amazon-auror - Markdown EN: https://fernando.moretes.com/blog/aurora-dsql-multi-regiao-retro-de-resiliencia-em-sistemas-financeiros-amazon-auror/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aurora-dsql-multi-regiao-retro-de-resiliencia-em-sistemas-financeiros-amazon-auror/article.md?lang=pt - Category: Security & Resilience - Tags: aurora-dsql, multi-region, active-active, distributed-sql, financial-grade, resilience, strong-consistency, aws-well-architected ### Migrating to Native Git in SageMaker Unified Studio SageMaker Unified Studio replaced the automatic sync model with flexible, file-level Git version control spanning Query Editor, Visual ETL, Workflows, and Notebooks in a unified experience. For teams in regulated environments, this change is not cosmetic, it redefines auditability, artifact traceability, and the governance model for analytical code. In this article, I walk through the migration journey, the real risks, and the architecture decisions that matter in production. - HTML: https://fernando.moretes.com/blog/migrando-para-git-nativo-no-sagemaker-unified-studio-amazon-sagem - Markdown EN: https://fernando.moretes.com/blog/migrando-para-git-nativo-no-sagemaker-unified-studio-amazon-sagem/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/migrando-para-git-nativo-no-sagemaker-unified-studio-amazon-sagem/article.md?lang=pt - Category: AI & Agents - Tags: sagemaker, git, mlops, governance, migration, dataops, fintech, devops ### AutoScalingInstanceRefresh in CloudFormation: Pattern Teardown The integration of Instance Refresh as a native CloudFormation update policy closes an operational gap that forced teams to orchestrate AMI deployments outside the IaC lifecycle. In this article, I dissect the pattern's anatomy, its real failure modes, and when it is, and is not, the right choice for high-criticality environments. - HTML: https://fernando.moretes.com/blog/autoscalinginstancerefresh-no-cloudformation-dissecando-o-padrao-amazon-ec2-a - Markdown EN: https://fernando.moretes.com/blog/autoscalinginstancerefresh-no-cloudformation-dissecando-o-padrao-amazon-ec2-a/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/autoscalinginstancerefresh-no-cloudformation-dissecando-o-padrao-amazon-ec2-a/article.md?lang=pt - Category: AWS & Cloud - Tags: ec2-auto-scaling, cloudformation, instance-refresh, deployment-patterns, iac, reliability, financial-grade, devops ### TBAC vs Explicit ARN vs SCP vs VPC Isolation in Neptune Neptune now supports Tag-Based Access Control (TBAC) for IAM, adding a fourth access control model to a service that already offered VPC isolation, IAM authentication with explicit ARNs, and Service Control Policies. Choosing the right model, or the right combination, has direct implications for security posture, team onboarding velocity, and operational cost in financial data platforms. - HTML: https://fernando.moretes.com/blog/tbac-vs-arn-explicito-vs-scp-vs-vpc-isolation-no-neptune-amazon-neptu - Markdown EN: https://fernando.moretes.com/blog/tbac-vs-arn-explicito-vs-scp-vs-vpc-isolation-no-neptune-amazon-neptu/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/tbac-vs-arn-explicito-vs-scp-vs-vpc-isolation-no-neptune-amazon-neptu/article.md?lang=pt - Category: Security & Resilience - Tags: neptune, iam, tbac, abac, zero-trust, graph-database, financial-grade, aws-security ### Amazon Connect + AVD/Windows 365: Audio Optimization in VDI AWS announced Amazon Connect audio optimization support for Azure Virtual Desktop (AVD) and Windows 365 Cloud PC via Microsoft Multimedia Redirection (MMR), extending a capability already present for WorkSpaces, Citrix, and Omnissa. The mechanism redirects media processing from the session host to the agent's local device, reducing latency and improving voice quality in heterogeneous VDI environments. In this article, I assess what this feature actually delivers, where it falls short, and how to integrate it into financial-grade contact center architectures. - HTML: https://fernando.moretes.com/blog/amazon-connect-avd-windows-365-otimizacao-de-audio-em-vdi-amazon-conne - Markdown EN: https://fernando.moretes.com/blog/amazon-connect-avd-windows-365-otimizacao-de-audio-em-vdi-amazon-conne/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/amazon-connect-avd-windows-365-otimizacao-de-audio-em-vdi-amazon-conne/article.md?lang=pt - Category: AI & Agents - Tags: amazon-connect, vdi, azure-virtual-desktop, windows-365, webrtc, contact-center, audio-optimization, mmr ### VDI Media Redirection in Amazon Connect: How It Really Works Amazon Connect's support for Azure Virtual Desktop and Windows 365 via Microsoft Multimedia Redirection looks simple on the surface, but it hides a media routing decision chain with serious implications for latency, security, and compliance. In this article I dissect the mechanism layer by layer, expose the failure modes the documentation doesn't mention, and offer a design model for high-demand financial environments. - HTML: https://fernando.moretes.com/blog/redirecionamento-de-midia-vdi-no-amazon-connect-como-realmente-funcion-amazon-conne - Markdown EN: https://fernando.moretes.com/blog/redirecionamento-de-midia-vdi-no-amazon-connect-como-realmente-funcion-amazon-conne/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/redirecionamento-de-midia-vdi-no-amazon-connect-como-realmente-funcion-amazon-conne/article.md?lang=pt - Category: Security & Resilience - Tags: amazon-connect, vdi, webrtc, azure-virtual-desktop, media-redirection, contact-center, financial-grade, observability ### Amazon Connect + AVD: VDI Audio Optimization in Financial-Grade Environments Amazon Connect's native media redirection support for Azure Virtual Desktop and Windows 365 Cloud PC closes a critical operational gap in financial contact centers that have already migrated agents to hybrid VDI. The mechanism uses Microsoft Multimedia Redirection (MMR) to offload WebRTC audio processing from the session host to the agent's local device, reducing perceived latency and eliminating the double-encoding that degrades voice quality. This article details what changes architecturally, the deployment gotchas, and an actionable checklist for platform teams. - HTML: https://fernando.moretes.com/blog/amazon-connect-avd-otimizacao-de-audio-vdi-em-ambientes-financeiros-amazon-conne - Markdown EN: https://fernando.moretes.com/blog/amazon-connect-avd-otimizacao-de-audio-vdi-em-ambientes-financeiros-amazon-conne/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/amazon-connect-avd-otimizacao-de-audio-vdi-em-ambientes-financeiros-amazon-conne/article.md?lang=pt - Category: AI & Agents - Tags: amazon-connect, vdi, azure-virtual-desktop, audio-optimization, contact-center, webrtc, financial-grade, hybrid-cloud ### Zone-Aware Routing in ECS Service Connect: The End of the Cost vs. Resilience Trade-off ECS Service Connect gained zone-aware routing in July 2026, automatically preferring same-AZ endpoints without additional code. For financial architectures with high-frequency service-to-service calls, this materially changes the economics of multi-AZ design. In this article, I analyze the mechanism, real trade-offs, and how to position this feature in payment platforms and real-time data systems. - HTML: https://fernando.moretes.com/blog/zone-aware-routing-no-ecs-service-connect-o-fim-do-trade-off-custo-vs--amazon-ecs-s - Markdown EN: https://fernando.moretes.com/blog/zone-aware-routing-no-ecs-service-connect-o-fim-do-trade-off-custo-vs--amazon-ecs-s/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/zone-aware-routing-no-ecs-service-connect-o-fim-do-trade-off-custo-vs--amazon-ecs-s/article.md?lang=pt - Category: AWS & Cloud - Tags: ECS, Service Connect, Zone-Aware Routing, Multi-AZ, FinTech, Cost Optimization, Resiliência, Microservices ### C7a in us-west-1: Migration Retro and Production Resilience The EC2 C7a landing in us-west-1 in July 2026 looks trivial, one more region, one more instance type. But for teams running compute-intensive workloads under tight SLOs, every regional expansion carries real migration risks that rarely surface in announcements. In this retro, I analyze what can (and usually does) go wrong, the systemic root cause, and how to build the right remediation. - HTML: https://fernando.moretes.com/blog/c7a-em-us-west-1-retro-de-migracao-e-resiliencia-em-producao-amazon-ec2-c - Markdown EN: https://fernando.moretes.com/blog/c7a-em-us-west-1-retro-de-migracao-e-resiliencia-em-producao-amazon-ec2-c/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/c7a-em-us-west-1-retro-de-migracao-e-resiliencia-em-producao-amazon-ec2-c/article.md?lang=pt - Category: Solution Architecture - Tags: ec2, c7a, amd-epyc, migration, resilience, financial-grade, well-architected, incident-retro ### Migrating High-Network Workloads to EC2 R6in/R6idn in Paris and Canada The availability of R6in and R6idn instances in Europe (Paris) and Canada (Central) in July 2026 closes a critical data-residency gap for financial-grade and real-time analytics workloads. This article narrates the migration journey from R5n to R6in/R6idn instances, detailing architecture decisions, operational risks, and the measurable network and IOPS gains that justify the move. - HTML: https://fernando.moretes.com/blog/migrando-workloads-de-alta-rede-para-ec2-r6in-r6idn-em-paris-e-canada-amazon-ec2-r - Markdown EN: https://fernando.moretes.com/blog/migrando-workloads-de-alta-rede-para-ec2-r6in-r6idn-em-paris-e-canada-amazon-ec2-r/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/migrando-workloads-de-alta-rede-para-ec2-r6in-r6idn-em-paris-e-canada-amazon-ec2-r/article.md?lang=pt - Category: AWS & Cloud - Tags: ec2, r6in, migration, financial-grade, networking, efa, data-residency, performance ### FinOps for Generative AI: Dissecting the Bedrock Cost Pattern in CUR 2.0 With standardized Bedrock metadata now available in AWS Data Exports, generative AI cost attribution no longer depends on brittle free-text field parsing, it gains native structure in CUR 2.0. In this article, I dissect the anatomy of this pattern, the scenarios where it genuinely solves the problem, and the failure modes that persist when AI governance is not aligned with the FinOps pipeline. - HTML: https://fernando.moretes.com/blog/finops-para-ia-generativa-dissecando-o-padrao-de-custo-bedrock-no-cur--aws-data-exp - Markdown EN: https://fernando.moretes.com/blog/finops-para-ia-generativa-dissecando-o-padrao-de-custo-bedrock-no-cur--aws-data-exp/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/finops-para-ia-generativa-dissecando-o-padrao-de-custo-bedrock-no-cur--aws-data-exp/article.md?lang=pt - Category: AI & Agents - Tags: finops, bedrock, cur2, aws-data-exports, cost-attribution, generative-ai, athena, governance ### New York suspends new data centers above 50 MW Governor Kathy Hochul signed an order pausing new 50 MW+ data centers for up to a year while the state runs an environmental study. It targets AI's pressure on the grid, water use and cost-shifting to the public, and signals a new regulatory risk for anyone designing cloud and AI workloads. - HTML: https://fernando.moretes.com/blog/nova-york-suspende-data-centers-acima-de-50-mw - Markdown EN: https://fernando.moretes.com/blog/nova-york-suspende-data-centers-acima-de-50-mw/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/nova-york-suspende-data-centers-acima-de-50-mw/article.md?lang=pt - Category: Data Platforms - Tags: data-centers, sustentabilidade, energia, inteligencia-artificial, nova-york, regulacao, finops, well-architected ### IAM Roles for Stream Sessions: A Credential Strategy Bake-Off IAM role support for Amazon GameLift Streams sessions, launched in July 2026, eliminates the need for long-lived access keys in streaming applications. In this article I compare the four available credential approaches, static keys, environment variables, AWS Secrets Manager, and IAM roles via RoleArn, using security, operational complexity, cost, and auditability as axes. The conclusion is straightforward: IAM roles wins on nearly every dimension that matters in production environments. - HTML: https://fernando.moretes.com/blog/iam-roles-para-stream-sessions-comparativo-de-estrategias-de-credencia-amazon-gamel - Markdown EN: https://fernando.moretes.com/blog/iam-roles-para-stream-sessions-comparativo-de-estrategias-de-credencia-amazon-gamel/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/iam-roles-para-stream-sessions-comparativo-de-estrategias-de-credencia-amazon-gamel/article.md?lang=pt - Category: Security & Resilience - Tags: iam, gamelift-streams, security, credentials, zero-trust, aws, devSecOps, cloud-native ### IAM Roles for GameLift Streams: The End of Embedded Credentials Amazon GameLift Streams now supports IAM roles for stream sessions, eliminating the need for long-lived credentials embedded in application bundles or passed as environment variables. The change aligns the service with the same container credential provider mechanism already trusted by ECS and EKS, with no application code changes required. In this article, I analyze what this feature actually delivers, where meaningful limits remain, and how to adopt it rigorously in production environments. - HTML: https://fernando.moretes.com/blog/iam-roles-para-gamelift-streams-o-fim-das-credenciais-embutidas-amazon-gamel - Markdown EN: https://fernando.moretes.com/blog/iam-roles-para-gamelift-streams-o-fim-das-credenciais-embutidas-amazon-gamel/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/iam-roles-para-gamelift-streams-o-fim-das-credenciais-embutidas-amazon-gamel/article.md?lang=pt - Category: Security & Resilience - Tags: gamelift-streams, iam, security, zero-trust, credentials, aws, cloud-native, devSecOps ### Amazon Managed Grafana FedRAMP High: Observability in Regulated Environments Amazon Managed Grafana has achieved FedRAMP High authorization in AWS GovCloud (US-East) and (US-West) regions, unlocking managed observability for federal agencies and sectors with strict compliance requirements. In this article, I analyze what that authorization actually means architecturally, the design patterns it enables, and the anti-patterns that persist even with an authorized service. - HTML: https://fernando.moretes.com/blog/amazon-managed-grafana-fedramp-high-observabilidade-em-ambientes-regul-amazon-manag - Markdown EN: https://fernando.moretes.com/blog/amazon-managed-grafana-fedramp-high-observabilidade-em-ambientes-regul-amazon-manag/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/amazon-managed-grafana-fedramp-high-observabilidade-em-ambientes-regul-amazon-manag/article.md?lang=pt - Category: Security & Resilience - Tags: fedramp, govcloud, grafana, observability, compliance, security, iam, zero-trust ### CloudWatch Logs Intelligent Tiering: Field Guide for Financial-Grade Environments CloudWatch Logs Intelligent Tiering arrived in July 2026 promising lower log retention costs without operational overhead, but for financial-grade environments with audit requirements, the story is more nuanced. In this field note, I analyze the three tiers, the automatic transition thresholds, and where this feature genuinely delivers value versus where it can create unpleasant surprises. - HTML: https://fernando.moretes.com/blog/cloudwatch-logs-intelligent-tiering-guia-de-campo-para-ambientes-finan-amazon-cloud - Markdown EN: https://fernando.moretes.com/blog/cloudwatch-logs-intelligent-tiering-guia-de-campo-para-ambientes-finan-amazon-cloud/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/cloudwatch-logs-intelligent-tiering-guia-de-campo-para-ambientes-finan-amazon-cloud/article.md?lang=pt - Category: Data Platforms - Tags: cloudwatch, observability, cost-optimization, financial-grade, log-management, aws-well-architected, sre, compliance ### DRS + EBS Initialization Rate: Predictable RTO in Financial-Grade Environments AWS Elastic Disaster Recovery now supports EBS Provisioned Rate for Volume Initialization, eliminating storage performance variability from the critical RTO path. For financial systems architects, this shifts the conversation from 'we hope the volume initializes in time' to 'we know exactly when storage will reach full performance'. The signal is small on the surface, but the impact on DR design is substantial. - HTML: https://fernando.moretes.com/blog/drs-ebs-initialization-rate-rto-previsivel-em-ambientes-financeiros-aws-elastic- - Markdown EN: https://fernando.moretes.com/blog/drs-ebs-initialization-rate-rto-previsivel-em-ambientes-financeiros-aws-elastic-/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/drs-ebs-initialization-rate-rto-previsivel-em-ambientes-financeiros-aws-elastic-/article.md?lang=pt - Category: Security & Resilience - Tags: disaster-recovery, aws-drs, ebs, rto, financial-grade, storage-performance, resilience, well-architected ### GPT-5.6 on Bedrock: Adoption Retro for Financial-Grade Environments The July 13, 2026 launch of GPT-5.6 Sol, Terra, and Luna on Amazon Bedrock exposed rushed adoption patterns I have seen repeatedly in regulated financial environments. This retro examines what happens when engineering teams integrate third-party models via Bedrock without adequate governance controls, and how to correct course before the next incident occurs. - HTML: https://fernando.moretes.com/blog/gpt-5-6-no-bedrock-retro-de-adocao-em-ambientes-financeiros-openai-gpt-5 - Markdown EN: https://fernando.moretes.com/blog/gpt-5-6-no-bedrock-retro-de-adocao-em-ambientes-financeiros-openai-gpt-5/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/gpt-5-6-no-bedrock-retro-de-adocao-em-ambientes-financeiros-openai-gpt-5/article.md?lang=pt - Category: AI & Agents - Tags: amazon-bedrock, gpt-5.6, agentic-ai, financial-grade, prompt-caching, zero-trust, incident-retro, llm-governance ### Migrating Financial Workloads to EC2 R8i: Decisions and Trade-offs The July 2026 availability of EC2 R8i instances (R8in, R8ib, R8idn, R8idb) in Tokyo, Frankfurt and Ireland opens a concrete modernization window for financial platforms still running on R6i/R6in, generations with real network bandwidth and EBS throughput ceilings. This article narrates the migration journey as a sequence of architecture decisions, with risks managed at each step and the numbers that justify the move. - HTML: https://fernando.moretes.com/blog/migrando-workloads-financeiros-para-ec2-r8i-decisoes-e-trade-offs-amazon-ec2-n - Markdown EN: https://fernando.moretes.com/blog/migrando-workloads-financeiros-para-ec2-r8i-decisoes-e-trade-offs-amazon-ec2-n/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/migrando-workloads-financeiros-para-ec2-r8i-decisoes-e-trade-offs-amazon-ec2-n/article.md?lang=pt - Category: AWS & Cloud - Tags: EC2, R8i, migration, financial-grade, MSK, EBS, networking, performance ### R8i: Anatomy of an Instance Family for I/O-Intensive Workloads The R8i family lands in Tokyo, Frankfurt, and Ireland with 600 Gbps network bandwidth and 300 Gbps EBS bandwidth, the highest figures among non-accelerated EC2 instances. Before migrating critical workloads, it is worth dissecting the anatomy of these four variants, understanding the real trade-offs, and knowing precisely when this family solves the problem and when it is the wrong choice. - HTML: https://fernando.moretes.com/blog/r8i-anatomia-de-uma-familia-de-instancias-para-workloads-intensivos-amazon-ec2-n - Markdown EN: https://fernando.moretes.com/blog/r8i-anatomia-de-uma-familia-de-instancias-para-workloads-intensivos-amazon-ec2-n/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/r8i-anatomia-de-uma-familia-de-instancias-para-workloads-intensivos-amazon-ec2-n/article.md?lang=pt - Category: AWS & Cloud - Tags: ec2, r8i, nitro, efa, financial-grade, data-platform, storage, networking ### OAuth on AWS MCP Server: Auth Strategy Bake-Off for AI Agents Native OAuth support on the AWS MCP Server changes the game for teams that were improvising agent authentication with static credentials or custom Cognito flows. But 'OAuth support' is not an architecture decision, it is a starting point. In this article, I run an honest bake-off across four authentication strategies for AI agents in financial-grade environments, with real trade-offs, plausible numbers, and a direct recommendation. - HTML: https://fernando.moretes.com/blog/oauth-no-aws-mcp-server-comparativo-de-estrategias-de-autenticacao-par-oauth-suppor - Markdown EN: https://fernando.moretes.com/blog/oauth-no-aws-mcp-server-comparativo-de-estrategias-de-autenticacao-par-oauth-suppor/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/oauth-no-aws-mcp-server-comparativo-de-estrategias-de-autenticacao-par-oauth-suppor/article.md?lang=pt - Category: AI & Agents - Tags: MCP, OAuth, IAM, AI Agents, Bedrock, Security, Zero Trust, Financial Grade ### AWS Builder Center Sandboxes: Technical Review and Architecture Analysis AWS Builder Center now offers free, time-limited sandbox environments directly within workshops, removing the need for a personal account or credit card. The proposition is solid for onboarding and controlled experimentation, but there are operational and governance limits that engineering teams need to understand before integrating this resource into enablement tracks. This is an honest technical review focused on isolation, lifecycle, adoption patterns, and where the offering still falls short. - HTML: https://fernando.moretes.com/blog/aws-builder-center-sandboxes-revisao-tecnica-e-analise-arquitetural-aws-builder- - Markdown EN: https://fernando.moretes.com/blog/aws-builder-center-sandboxes-revisao-tecnica-e-analise-arquitetural-aws-builder-/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aws-builder-center-sandboxes-revisao-tecnica-e-analise-arquitetural-aws-builder-/article.md?lang=pt - Category: AWS & Cloud - Tags: aws-builder-center, sandbox, cloud-training, devex, governance, well-architected, onboarding, platform-engineering ### GameLift Streams Admin Shell: Secure Live-Session Access Without SSH Amazon GameLift Streams now provides secure terminal access to live sessions via SSM Session Manager, no SSH, no open ports, no infrastructure credentials. This mechanism has serious architectural implications for teams operating streaming platforms at scale, particularly around audit trails, blast radius, and ephemeral access control. I analyze how the feature works internally, where it can fail, and how to integrate it safely in financially critical environments. - HTML: https://fernando.moretes.com/blog/admin-shell-no-gamelift-streams-acesso-seguro-sem-ssh-em-sessoes-ao-vi-amazon-gamel - Markdown EN: https://fernando.moretes.com/blog/admin-shell-no-gamelift-streams-acesso-seguro-sem-ssh-em-sessoes-ao-vi-amazon-gamel/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/admin-shell-no-gamelift-streams-acesso-seguro-sem-ssh-em-sessoes-ao-vi-amazon-gamel/article.md?lang=pt - Category: Data Platforms - Tags: gamelift-streams, ssm-session-manager, zero-trust, secure-access, observability, iam, streaming, devops ### DPD on HyperPod: Disaggregated Prefill and Decode in Production SageMaker HyperPod now supports Disaggregated Prefill and Decode (DPD), separating the two LLM inference phases onto dedicated GPU pools connected via EFA and GPU-Direct RDMA. This change resolves one of the most persistent production problems: a single long-context request degrading per-token latency for every concurrent request. In this article, I analyze the real trade-offs, the failure modes you will encounter, and a playbook for enabling DPD on demanding financial-grade workloads. - HTML: https://fernando.moretes.com/blog/dpd-no-hyperpod-prefill-e-decode-disagregados-em-producao-amazon-sagem - Markdown EN: https://fernando.moretes.com/blog/dpd-no-hyperpod-prefill-e-decode-disagregados-em-producao-amazon-sagem/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/dpd-no-hyperpod-prefill-e-decode-disagregados-em-producao-amazon-sagem/article.md?lang=pt - Category: AI & Agents - Tags: sagemaker-hyperpod, llm-inference, disaggregated-inference, gpu-optimization, efa-rdma, kv-cache, financial-ai, mlops ### SageMaker Unified Studio + Terraform: IaC for Financial-Grade AI Platforms The official Terraform support for SageMaker Unified Studio, launched in July 2026, closes a critical gap for platform teams operating in regulated financial environments: the ability to version, audit, and promote AI/data domains with the same rigor applied to any other infrastructure resource. This briefing analyzes what changes in practice, where the real risks lie, and how to position this capability within an Internal Developer Platform strategy. - HTML: https://fernando.moretes.com/blog/sagemaker-unified-studio-terraform-iac-para-plataformas-de-ia-financei-amazon-sagem - Markdown EN: https://fernando.moretes.com/blog/sagemaker-unified-studio-terraform-iac-para-plataformas-de-ia-financei-amazon-sagem/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/sagemaker-unified-studio-terraform-iac-para-plataformas-de-ia-financei-amazon-sagem/article.md?lang=pt - Category: AI & Agents - Tags: sagemaker, terraform, iac, data-platform, governance, fintech, mlops, internal-developer-platform ### SageMaker Unified Studio + Terraform: IaC for AI Platforms Incident Retro The absence of reproducible infrastructure-as-code for unified AI platforms is not a convenience problem, it is a vector for governance incidents, configuration drift, and audit failures in financial-grade environments. Terraform support for Amazon SageMaker Unified Studio, launched in July 2026, closes a critical gap I have seen cause real incidents at multiple enterprise customers. This retro analyzes the failure pattern, the typical timeline, and the resilience changes that must follow. - HTML: https://fernando.moretes.com/blog/sagemaker-unified-studio-terraform-retro-de-incidente-em-iac-para-ia-amazon-sagem - Markdown EN: https://fernando.moretes.com/blog/sagemaker-unified-studio-terraform-retro-de-incidente-em-iac-para-ia-amazon-sagem/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/sagemaker-unified-studio-terraform-retro-de-incidente-em-iac-para-ia-amazon-sagem/article.md?lang=pt - Category: AI & Agents - Tags: sagemaker, terraform, iac, data-governance, mlops, devSecOps, well-architected, incident-retro ### SageMaker Unified Studio via Terraform: Migrating to IaC in Financial-Grade Environments Terraform support for Amazon SageMaker Unified Studio, announced in July 2026, closes a critical gap for data platforms in regulated environments: ML domains that previously required ClickOps or brittle SDK automation can now be versioned, reviewed, and promoted like any other infrastructure resource. In this article, I analyze the migration journey from a console-driven initial state to a full IaC pipeline, with particular attention to the IAM pitfalls, blueprint governance, and operational observability that make the difference in financial-grade environments. - HTML: https://fernando.moretes.com/blog/sagemaker-unified-studio-via-terraform-migrando-para-iac-em-ambientes--amazon-sagem - Markdown EN: https://fernando.moretes.com/blog/sagemaker-unified-studio-via-terraform-migrando-para-iac-em-ambientes--amazon-sagem/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/sagemaker-unified-studio-via-terraform-migrando-para-iac-em-ambientes--amazon-sagem/article.md?lang=pt - Category: AI & Agents - Tags: sagemaker, terraform, iac, data-platform, mlops, governance, financial-grade, devops ### IaC for AI Platforms: Terraform and SageMaker Unified Studio Official Terraform support for SageMaker Unified Studio closes a critical gap: AI platforms can now be provisioned with the same IaC rigor applied to networks and databases. In this article I dissect the pattern, its modular anatomy, when it solves the right problem, and when it conceals dangerous technical debt. - HTML: https://fernando.moretes.com/blog/iac-para-plataformas-de-ia-terraform-e-sagemaker-unified-studio-amazon-sagem - Markdown EN: https://fernando.moretes.com/blog/iac-para-plataformas-de-ia-terraform-e-sagemaker-unified-studio-amazon-sagem/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/iac-para-plataformas-de-ia-terraform-e-sagemaker-unified-studio-amazon-sagem/article.md?lang=pt - Category: AI & Agents - Tags: terraform, sagemaker, iac, mlops, data-governance, platform-engineering, finops, devsecops ### CloudWatch Logs Tag Enrichment vs. Alternative Approaches CloudWatch Logs now enriches log events with resource tags at ingestion time, at no extra cost and without instrumentation changes. But does this replace custom enrichment pipelines, OpenTelemetry-based approaches, or third-party solutions like Datadog? I do an honest trade-off analysis for teams running financial-grade systems on AWS. - HTML: https://fernando.moretes.com/blog/tag-enrichment-no-cloudwatch-logs-vs-abordagens-alternativas-amazon-cloud - Markdown EN: https://fernando.moretes.com/blog/tag-enrichment-no-cloudwatch-logs-vs-abordagens-alternativas-amazon-cloud/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/tag-enrichment-no-cloudwatch-logs-vs-abordagens-alternativas-amazon-cloud/article.md?lang=pt - Category: Data Platforms - Tags: CloudWatch, Observability, Log Enrichment, OpenTelemetry, FinancialGrade, Tagging, MSK, DataMesh ### AWS WAF on AgentCore Gateway: Production Security for Agentic AI The general availability of AWS WAF for Amazon Bedrock AgentCore Gateway marks an important inflection point: agentic AI workloads can now receive consistent edge protections without per-agent instrumentation. I analyze what this integration actually delivers, where it still leaves gaps, and how to build a mature security posture for agentic systems in production. - HTML: https://fernando.moretes.com/blog/aws-waf-no-agentcore-gateway-seguranca-de-producao-para-ia-agentica-aws-waf-adds - Markdown EN: https://fernando.moretes.com/blog/aws-waf-no-agentcore-gateway-seguranca-de-producao-para-ia-agentica-aws-waf-adds/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aws-waf-no-agentcore-gateway-seguranca-de-producao-para-ia-agentica-aws-waf-adds/article.md?lang=pt - Category: AI & Agents - Tags: aws-waf, bedrock-agentcore, agentic-ai, zero-trust, api-security, financial-grade, security, llm-ops ### The IDE Became the Exception: How I Shifted to Building Loops Instead of Code After 16 years building financial-grade systems on AWS, I realized my job changed: I no longer design code line by line, I design loops, triggers, topologies, verifiers, and stop-rules. The IDE still exists on my workbench, but less and less. This post is the honest record of that transition. - HTML: https://fernando.moretes.com/blog/ide-virou-excecao-loop-engineering-nos-meus-agentes - Markdown EN: https://fernando.moretes.com/blog/ide-virou-excecao-loop-engineering-nos-meus-agentes/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ide-virou-excecao-loop-engineering-nos-meus-agentes/article.md?lang=pt - Category: AI & Agents - Tags: loop-engineering, ai-agents, aws-bedrock, eventbridge, prompt-engineering, serverless, agentic-ai, developer-productivity ### EC2 R8g and Graviton4: A Technical Deep Dive for Memory-Intensive Workloads EC2 R8g instances powered by Graviton4 are now available in regions including Africa (Cape Town), Europe (Milan), and Asia Pacific (Thailand, New Zealand), delivering up to 1.5 TB of memory and 3x more vCPUs than the previous generation. In this article, I analyze the real mechanisms behind this performance leap, the migration trade-offs, and the design patterns that make these instances relevant for critical financial-grade systems. - HTML: https://fernando.moretes.com/blog/ec2-r8g-e-graviton4-analise-tecnica-para-workloads-memory-intensive-amazon-ec2-r - Markdown EN: https://fernando.moretes.com/blog/ec2-r8g-e-graviton4-analise-tecnica-para-workloads-memory-intensive-amazon-ec2-r/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ec2-r8g-e-graviton4-analise-tecnica-para-workloads-memory-intensive-amazon-ec2-r/article.md?lang=pt - Category: AWS & Cloud - Tags: ec2, graviton4, r8g, memory-optimized, nitro, financial-grade, arm64, performance ### EC2 R8g in New Regions: Migration Field Guide for Financial Workloads The expansion of EC2 R8g instances to Thailand, New Zealand, Cape Town, Milan, and Calgary is far more than a regional availability note, it is an architecture decision with direct implications for latency, data compliance, and operational cost. In this article, I document what I learned migrating memory-intensive financial workloads from R7g to R8g, including the gotchas that never appear in the official docs. - HTML: https://fernando.moretes.com/blog/ec2-r8g-em-novas-regioes-guia-de-migracao-para-workloads-financeiros-amazon-ec2-r - Markdown EN: https://fernando.moretes.com/blog/ec2-r8g-em-novas-regioes-guia-de-migracao-para-workloads-financeiros-amazon-ec2-r/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ec2-r8g-em-novas-regioes-guia-de-migracao-para-workloads-financeiros-amazon-ec2-r/article.md?lang=pt - Category: AWS & Cloud - Tags: ec2, graviton4, r8g, memory-optimized, migration, financial-workloads, arm64, aws-regions ### Graviton4 R8g: Global Expansion and What Changes for Memory-Intensive Architectures AWS has expanded EC2 R8g Graviton4 instances to five new regions: Thailand, New Zealand, South Africa, Italy, and Canada West, completing a global rollout that reshapes the cost-performance equation for memory-intensive workloads outside major hubs. With up to 1.5 TB RAM, 48xlarge sizing, and 40% database gains over Graviton3, this is not an incremental upgrade. It is a platform maturity signal that changes architecture decisions in regions where instance choice was previously constrained. - HTML: https://fernando.moretes.com/blog/graviton4-r8g-expansao-global-e-o-que-muda-para-arquiteturas-de-alta-m-amazon-ec2-r - Markdown EN: https://fernando.moretes.com/blog/graviton4-r8g-expansao-global-e-o-que-muda-para-arquiteturas-de-alta-m-amazon-ec2-r/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/graviton4-r8g-expansao-global-e-o-que-muda-para-arquiteturas-de-alta-m-amazon-ec2-r/article.md?lang=pt - Category: AWS & Cloud - Tags: graviton4, ec2-r8g, memory-optimized, aws-regions, financial-grade, cost-optimization, arm64, database-performance ### C7a in Singapore: A Migration Incident Retro for Financial-Grade Systems The EC2 C7a landing in Asia Pacific (Singapore) on June 25, 2026 is not just a hardware announcement, it is a migration trigger with real traps for teams running low-latency financial workloads in the region. In this retro, I walk through what happens when teams migrate from C6a to C7a without proper preparation: from EBS volume limit surprises to performance regressions caused by NUMA misconfiguration. I close with a concrete set of resilience changes I would apply immediately. - HTML: https://fernando.moretes.com/blog/c7a-em-singapura-retro-de-migracao-em-ambiente-financeiro-amazon-ec2-c - Markdown EN: https://fernando.moretes.com/blog/c7a-em-singapura-retro-de-migracao-em-ambiente-financeiro-amazon-ec2-c/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/c7a-em-singapura-retro-de-migracao-em-ambiente-financeiro-amazon-ec2-c/article.md?lang=pt - Category: Solution Architecture - Tags: ec2, c7a, amd-epyc, migration, financial-systems, ebs, singapore, well-architected ### AMI Watermarks: Image Governance at Financial-Grade Scale AMI Watermarks arrive in EC2 as a provenance primitive that persists across cross-region copies, cross-account sharing, and new AMI creation from running instances. For financial environments with hundreds of accounts and dozens of regions, this solves a problem that tag scripts and SCPs partially addressed, but never reliably. In this article, I walk through the migration journey from an ad hoc model to an auditable chain of custody. - HTML: https://fernando.moretes.com/blog/ami-watermarks-governanca-de-imagens-em-escala-financeira-amazon-ec2-a - Markdown EN: https://fernando.moretes.com/blog/ami-watermarks-governanca-de-imagens-em-escala-financeira-amazon-ec2-a/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ami-watermarks-governanca-de-imagens-em-escala-financeira-amazon-ec2-a/article.md?lang=pt - Category: Security & Resilience - Tags: AMI, EC2, governance, security, DevSecOps, image-builder, compliance, zero-trust ### Amazon Bedrock AgentCore Harness: From Idea to Production-Grade Agent AgentCore Harness reached GA in June 2026 as a managed abstraction that collapses the LLM agent control plane into two API calls. In this article, I analyze how the harness works internally, where it fails, and what architects of financial-grade systems need to understand before putting it into production. - HTML: https://fernando.moretes.com/blog/amazon-bedrock-agentcore-harness-da-ideia-ao-agente-de-producao-amazon-bedro - Markdown EN: https://fernando.moretes.com/blog/amazon-bedrock-agentcore-harness-da-ideia-ao-agente-de-producao-amazon-bedro/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/amazon-bedrock-agentcore-harness-da-ideia-ao-agente-de-producao-amazon-bedro/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, agentcore, agentic-ai, aws, financial-grade, observability, security, llm-orchestration ### Managed Syslog Ingestion in CloudWatch: Anatomy of a Pattern CloudWatch Logs now accepts syslog directly via VPC endpoint, no agents, with automatic parsing of RFC 5424, RFC 3164, and Cisco FTD/ASA. This shifts the log collection pattern for network devices and Linux servers in regulated environments. In this article, I dissect the pattern anatomy, its real limits, and the anti-patterns I've seen burn teams in production. - HTML: https://fernando.moretes.com/blog/ingestao-gerenciada-de-syslog-no-cloudwatch-anatomia-de-um-padrao-amazon-cloud - Markdown EN: https://fernando.moretes.com/blog/ingestao-gerenciada-de-syslog-no-cloudwatch-anatomia-de-um-padrao-amazon-cloud/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ingestao-gerenciada-de-syslog-no-cloudwatch-anatomia-de-um-padrao-amazon-cloud/article.md?lang=pt - Category: AWS & Cloud - Tags: cloudwatch, syslog, observability, network-security, financial-grade, log-ingestion, vpc-endpoint, compliance ### AWS Lambda MicroVMs: technical review of a new serverless primitive AWS Lambda MicroVMs fills a genuine gap between ephemeral functions and heavy VMs, delivering hypervisor-level isolation with near-instant resume latency and state preserved for up to 8 hours. As an architect operating financial-grade multi-tenant environments, I see genuine potential here, and equally real pitfalls that must be addressed before any production adoption. - HTML: https://fernando.moretes.com/blog/aws-lambda-microvms-analise-tecnica-de-um-novo-primitivo-serverless-run-isolated - Markdown EN: https://fernando.moretes.com/blog/aws-lambda-microvms-analise-tecnica-de-um-novo-primitivo-serverless-run-isolated/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aws-lambda-microvms-analise-tecnica-de-um-novo-primitivo-serverless-run-isolated/article.md?lang=pt - Category: AWS & Cloud - Tags: lambda, microvms, firecracker, serverless, multi-tenant, isolation, fintech, agentic-ai ### Amazon Bedrock AgentCore: Continuous Agent Optimization in Production Amazon Bedrock AgentCore introduces a continuous improvement loop that turns production traces into actionable diagnostics, data-grounded recommendations, and statistical validation via A/B testing. For architects of financial systems and high-stakes platforms, this represents AWS's first serious attempt to close the gap between agent observability and reliable production operation. - HTML: https://fernando.moretes.com/blog/amazon-bedrock-agentcore-otimizacao-continua-de-agentes-em-producao-amazon-bedro - Markdown EN: https://fernando.moretes.com/blog/amazon-bedrock-agentcore-otimizacao-continua-de-agentes-em-producao-amazon-bedro/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/amazon-bedrock-agentcore-otimizacao-continua-de-agentes-em-producao-amazon-bedro/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, agentcore, agentic-ai, observability, mlops, aws, financial-grade, a-b-testing ### Bedrock Managed Knowledge Base: Anatomy of a Managed RAG Pipeline Amazon Bedrock Managed Knowledge Base abstracts the entire RAG stack, connectors, parsing, embeddings, re-ranking, and agentic retrieval, into a single managed primitive. In this article, I disassemble each layer, expose the failure modes the documentation doesn't mention, and analyze the real trade-offs for engineers designing financial-grade AI systems on AWS. - HTML: https://fernando.moretes.com/blog/bedrock-managed-knowledge-base-anatomia-de-um-pipeline-rag-gerenciado-introducing- - Markdown EN: https://fernando.moretes.com/blog/bedrock-managed-knowledge-base-anatomia-de-um-pipeline-rag-gerenciado-introducing-/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/bedrock-managed-knowledge-base-anatomia-de-um-pipeline-rag-gerenciado-introducing-/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, rag, knowledge-base, agentic-ai, enterprise-ai, aws, financial-grade, vector-search ### InvokeGuardrailChecks vs Classic Guardrails: Which to Use in AI Agents? AWS released the InvokeGuardrailChecks API in Amazon Bedrock Guardrails, a resourceless API that lets you apply individual safeguards at any point in an agentic loop without creating or versioning guardrail resources. In this article, I run a direct head-to-head between this approach and classic resource-based Guardrails, evaluating latency, governance, cost, and fitness for financial-grade mission-critical systems. - HTML: https://fernando.moretes.com/blog/invokeguardrailchecks-vs-guardrails-classicos-qual-usar-em-agentes-ai-amazon-bedro - Markdown EN: https://fernando.moretes.com/blog/invokeguardrailchecks-vs-guardrails-classicos-qual-usar-em-agentes-ai-amazon-bedro/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/invokeguardrailchecks-vs-guardrails-classicos-qual-usar-em-agentes-ai-amazon-bedro/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, guardrails, agentic-ai, security, financial-grade, aws, ai-governance, devSecOps ### EC2 G7 & NVIDIA Blackwell: GPU Inference Architecture for Production EC2 G7 instances, accelerated by NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs, represent a generational leap that goes well beyond benchmark numbers. In this analysis, I examine the real GPU-to-GPU communication mechanisms, failure patterns in multi-node clusters, and the architectural decisions that separate a functional inference deployment from a financial-grade fault-tolerant system. - HTML: https://fernando.moretes.com/blog/ec2-g7-e-nvidia-blackwell-arquitetura-de-inferencia-gpu-para-producao-announcing-a - Markdown EN: https://fernando.moretes.com/blog/ec2-g7-e-nvidia-blackwell-arquitetura-de-inferencia-gpu-para-producao-announcing-a/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ec2-g7-e-nvidia-blackwell-arquitetura-de-inferencia-gpu-para-producao-announcing-a/article.md?lang=pt - Category: AWS & Cloud - Tags: ec2-g7, nvidia-blackwell, gpu-inference, efa, gpudirect-rdma, eks, ai-infrastructure, financial-grade ### ECS Auto Scaling: High-Resolution Metrics vs. Traditional Scaling Approaches The launch of high-resolution (20-second) metrics for Amazon ECS reshapes the auto scaling calculus for latency-sensitive financial workloads. This article compares the four primary scaling approaches, target tracking with high resolution, step scaling, scheduled scaling, and predictive, with concrete trade-offs, real numbers, and a decision matrix for production environments. - HTML: https://fernando.moretes.com/blog/ecs-auto-scaling-metricas-de-alta-resolucao-vs-abordagens-tradicionais-amazon-ecs-i - Markdown EN: https://fernando.moretes.com/blog/ecs-auto-scaling-metricas-de-alta-resolucao-vs-abordagens-tradicionais-amazon-ecs-i/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ecs-auto-scaling-metricas-de-alta-resolucao-vs-abordagens-tradicionais-amazon-ecs-i/article.md?lang=pt - Category: AWS & Cloud - Tags: ECS, Auto Scaling, CloudWatch, Fargate, FinancialGrade, Observability, Kubernetes, CostOptimization ### AI Agents for Security and DevOps: Productivity or Risk? AWS launched frontier agents for security testing and cloud operations, opening a real debate about how far AI autonomy can go in regulated environments. This article compares four deployment patterns, fully autonomous agent, semi-autonomous with human approval, assisted (copilot), and deterministic pipeline, using concrete criteria of risk, cost, latency, and compliance. - HTML: https://fernando.moretes.com/blog/frontier-agents-seguranca-devops-produtividade-risco - Markdown EN: https://fernando.moretes.com/blog/frontier-agents-seguranca-devops-produtividade-risco/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/frontier-agents-seguranca-devops-produtividade-risco/article.md?lang=pt - Category: AI & Agents - Tags: bedrock-agents, security-automation, devops, governance, zero-trust, incident-response, aws-well-architected, agentic-ai ### Web Search on Bedrock AgentCore: An In-Depth Technical Review Web Search on Amazon Bedrock AgentCore delivers managed web search for AI agents, with zero data egress outside the AWS environment and MCP-based grounding. I review the capability with a senior architect's critical eye: real trade-offs, operational limits, and when adoption actually makes sense. - HTML: https://fernando.moretes.com/blog/web-search-no-bedrock-agentcore-revisao-tecnica-aprofundada-announcing-w - Markdown EN: https://fernando.moretes.com/blog/web-search-no-bedrock-agentcore-revisao-tecnica-aprofundada-announcing-w/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/web-search-no-bedrock-agentcore-revisao-tecnica-aprofundada-announcing-w/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, agentcore, agentic-ai, mcp, web-search, grounding, financial-grade, rag ### Lambda Response Streaming for Real-Time Pricing Engines Lambda response streaming fundamentally changes the serverless execution contract by allowing bytes to be flushed to the client before the function completes, with deep implications for real-time pricing engines. In this analysis I dissect the internal mechanism, the failure modes documentation underemphasizes, and the architecture decisions that separate a prototype from a production financial system. - HTML: https://fernando.moretes.com/blog/pricing-em-tempo-real-com-serverless-streaming-e-governanca - Markdown EN: https://fernando.moretes.com/blog/pricing-em-tempo-real-com-serverless-streaming-e-governanca/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/pricing-em-tempo-real-com-serverless-streaming-e-governanca/article.md?lang=pt - Category: AWS & Cloud - Tags: lambda, streaming, real-time-pricing, serverless, fintech, aws, event-driven, observability ### AWS Transform at 1 Year: Agentic Legacy Modernization in Production AWS Transform arrived promising AI-agent-driven legacy modernization, after one year, it's worth examining what it actually delivers, where it falls short, and what the real adoption cost is in critical systems. This analysis is grounded in concrete technical evidence, not marketing. - HTML: https://fernando.moretes.com/blog/aws-transform-modernizacao-agentic-legacy - Markdown EN: https://fernando.moretes.com/blog/aws-transform-modernizacao-agentic-legacy/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aws-transform-modernizacao-agentic-legacy/article.md?lang=pt - Category: Solution Architecture - Tags: aws-transform, modernization, agentic-ai, legacy, migration, governance, bedrock, financial-grade ### AWS FinOps Agent: Architecture, Mechanisms, and Production Trade-offs AWS FinOps Agent, announced in preview at AWS Summit New York 2026, represents a paradigm shift: from reactive dashboards to autonomous agents that investigate cost anomalies, generate recommendations, and execute actions in external systems like Jira and Slack. In this article, I dissect the agent's internal architecture, the failure modes nobody mentions, and the trade-offs any financial engineering team needs to understand before putting it into production. - HTML: https://fernando.moretes.com/blog/aws-finops-agent-arquitetura-mecanismos-e-trade-offs-em-producao-aws-weekly-r - Markdown EN: https://fernando.moretes.com/blog/aws-finops-agent-arquitetura-mecanismos-e-trade-offs-em-producao-aws-weekly-r/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aws-finops-agent-arquitetura-mecanismos-e-trade-offs-em-producao-aws-weekly-r/article.md?lang=pt - Category: AI & Agents - Tags: finops, aws-bedrock, agentic-ai, cost-optimization, well-architected, observability, financial-grade, aws-summit-2026 ### AWS WAF and AI Bot Traffic Monetization: A Technical Review AWS WAF has gained native capability to identify and route AI bot traffic, a shift that turns a defensive tool into a revenue control point. In this article, I analyze what the feature actually delivers, where it falls short, and how to integrate it safely in financial-grade architectures. - HTML: https://fernando.moretes.com/blog/ai-bots-waf-e-monetizacao-de-trafego-com-seguranca - Markdown EN: https://fernando.moretes.com/blog/ai-bots-waf-e-monetizacao-de-trafego-com-seguranca/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/ai-bots-waf-e-monetizacao-de-trafego-com-seguranca/article.md?lang=pt - Category: Security & Resilience - Tags: aws-waf, ai-bots, security, finops, api-gateway, monetization, edge, zero-trust ### Agentic RAG on AWS: Architecture Bake-Off for Financial-Grade Platforms Agentic RAG has moved from lab experiment to platform requirement in financial environments that demand auditability, cost control, and predictable latency. In this article I compare four concrete architectural approaches on AWS, with real trade-offs, plausible numbers, and an unambiguous recommendation. - HTML: https://fernando.moretes.com/blog/agentic-rag-confiavel-para-plataformas-enterprise - Markdown EN: https://fernando.moretes.com/blog/agentic-rag-confiavel-para-plataformas-enterprise/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/agentic-rag-confiavel-para-plataformas-enterprise/article.md?lang=pt - Category: AI & Agents - Tags: agentic-rag, bedrock, opensearch, eks, step-functions, financial-grade, governance, aws ### AML Alert Triage with Governed AI: Architecture and Trade-offs Automating AML alert triage with generative AI is technically feasible, but the distance between a working prototype and an auditable financial system is vast. In this article, I analyze the real architecture behind this automation, the orchestration mechanisms, the silent failure points, and the design decisions that separate a regulatorily defensible system from one that will fail a BACEN or FinCEN audit. - HTML: https://fernando.moretes.com/blog/aml-alert-triage-amazon-quick-mcp-snowflake - Markdown EN: https://fernando.moretes.com/blog/aml-alert-triage-amazon-quick-mcp-snowflake/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aml-alert-triage-amazon-quick-mcp-snowflake/article.md?lang=pt - Category: Financial Systems - Tags: aml, financial-services, generative-ai, mcp, snowflake, bedrock, governance, compliance ### LLM Observability in Production: From GPU Metrics to Response Quality Deploying an LLM to SageMaker is the easy part. The hard part is knowing, in real time, whether it is answering well, using GPU efficiently, and costing what you planned. This article details the observability stack I would build today for financial-grade LLM inference. - HTML: https://fernando.moretes.com/blog/llm-observabilidade-qualidade-custo-sagemaker-bedrock - Markdown EN: https://fernando.moretes.com/blog/llm-observabilidade-qualidade-custo-sagemaker-bedrock/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/llm-observabilidade-qualidade-custo-sagemaker-bedrock/article.md?lang=pt - Category: AI & Agents - Tags: llmops, observability, sagemaker, bedrock, grafana, opentelemetry, mlops, financial-grade ### Custom Lens for Data Platforms: Anatomy of a Pattern The AWS Well-Architected Custom Lens is often treated as a documentation artifact, but when applied to enterprise data platforms, it becomes an operational governance mechanism with real teeth. In this article, I dissect the pattern's anatomy, expose its most common adoption failures, and propose a reference design that connects lens reviews to automated remediation pipelines. - HTML: https://fernando.moretes.com/blog/well-architected-lens-para-plataformas-de-dados-enterprise - Markdown EN: https://fernando.moretes.com/blog/well-architected-lens-para-plataformas-de-dados-enterprise/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/well-architected-lens-para-plataformas-de-dados-enterprise/article.md?lang=pt - Category: Data Platforms - Tags: well-architected, custom-lens, data-platform, governance, data-mesh, glue, msk, finops ### Document Automation with Bedrock: A Modernization Journey Legacy document extraction pipelines in financial environments accumulate silent technical debt: brittle OCR, manual rules, and absent traceability. In this article, I narrate the modernization journey to Bedrock Data Automation, covering architecture decisions, managed risks, and what genuinely changes in operations. The analysis is grounded in real patterns from critical financial systems, not lab demos. - HTML: https://fernando.moretes.com/blog/bedrock-data-automation-para-documentos-clinicos-e-operacoes - Markdown EN: https://fernando.moretes.com/blog/bedrock-data-automation-para-documentos-clinicos-e-operacoes/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/bedrock-data-automation-para-documentos-clinicos-e-operacoes/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, document-ai, human-in-the-loop, step-functions, financial-grade, migration, audit, data-automation ### Prioritization Postmortem: When the Roadmap Becomes the Incident Roadmap prioritization decisions rarely feel like incidents until production breaks. This article reconstructs the anatomy of a real failure caused by accumulated technical debt, ignored ADRs, and delivery pressure, and proposes the structural changes that prevent recurrence. - HTML: https://fernando.moretes.com/blog/roadmap-tecnico-com-priorizacao-arquitetural - Markdown EN: https://fernando.moretes.com/blog/roadmap-tecnico-com-priorizacao-arquitetural/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/roadmap-tecnico-com-priorizacao-arquitetural/article.md?lang=pt - Category: Solution Architecture - Tags: roadmap, adr, incident-retro, governance, well-architected, platform-engineering, technical-debt, reliability ### Agent Evaluation as an Engineering Discipline AI agent evaluation has moved beyond ad hoc prompt engineering into a full engineering discipline with versioned datasets, automated quality gates, and regression traceability. Bedrock AgentCore materializes that shift by bringing managed infrastructure to the agent testing lifecycle. For financial-grade systems architects, this changes the contract between ML teams and platform engineering. - HTML: https://fernando.moretes.com/blog/avaliacao-agentes-bedrock-agentcore-datasets - Markdown EN: https://fernando.moretes.com/blog/avaliacao-agentes-bedrock-agentcore-datasets/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/avaliacao-agentes-bedrock-agentcore-datasets/article.md?lang=pt - Category: AI & Agents - Tags: bedrock-agentcore, agent-evaluation, ai-testing, quality-gates, mlops, financial-grade, devops, observability ### Oracle HA on AWS: FSx for ONTAP as a Lever for Gradual Modernization The most relevant signal in this cycle for architects still carrying critical Oracle workloads is not to abandon them, it is to orchestrate them with cloud-native primitives that deliver real HA without forcing a rewrite. FSx for NetApp ONTAP changes the storage equation for Oracle on AWS in concrete ways. This briefing analyzes what changes in practice, the real trade-offs, and how to position this layer within a gradual modernization strategy. - HTML: https://fernando.moretes.com/blog/oracle-ha-com-fsx-ontap-e-modernizacao-gradual - Markdown EN: https://fernando.moretes.com/blog/oracle-ha-com-fsx-ontap-e-modernizacao-gradual/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/oracle-ha-com-fsx-ontap-e-modernizacao-gradual/article.md?lang=pt - Category: Solution Architecture - Tags: oracle, fsx-ontap, high-availability, migration, financial-grade, storage, modernization, aws ### Contract Intelligence on AWS: Field-Notes Architecture Building contract intelligence with generative AI goes far beyond wiring an LLM to PDFs. This article documents the architectural patterns, operational gotchas, and design decisions that separate an impressive PoC from a reliable system in financial-grade production. - HTML: https://fernando.moretes.com/blog/contract-intelligence-com-ia-generativa-e-controles - Markdown EN: https://fernando.moretes.com/blog/contract-intelligence-com-ia-generativa-e-controles/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/contract-intelligence-com-ia-generativa-e-controles/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, rag, contracts, step-functions, kms, opensearch, financial-grade, agentic ### Postmortem: When AI Meets Resilience: AWS Resilience Hub and SRE AWS Resilience Hub gained generative AI capabilities for failure mode analysis and runbook generation, a change that looks incremental but redefines how SRE teams operate in production. In this retrospective, I analyze what this evolution means in practice, where it fails, and how to integrate these tools into financial-grade systems without creating new fragile dependencies. - HTML: https://fernando.moretes.com/blog/resilience-hub-genai-sre-operacao-moderna - Markdown EN: https://fernando.moretes.com/blog/resilience-hub-genai-sre-operacao-moderna/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/resilience-hub-genai-sre-operacao-moderna/article.md?lang=pt - Category: Security & Resilience - Tags: resilience-hub, sre, generative-ai, bedrock, runbooks, well-architected, failure-modes, financial-grade ### Scalable User Search with Amazon Cognito: A Deep-Dive Analysis Amazon Cognito excels at authentication, but its user-listing API was never designed for high-frequency search against large user pools. In this article, I analyze how to build a scalable search layer on top of Cognito, the failure modes that emerge when you ignore native API limits, and the real trade-offs between eventual consistency, data privacy, and operational cost. - HTML: https://fernando.moretes.com/blog/busca-de-usuarios-em-cognito-com-escala-e-privacidade - Markdown EN: https://fernando.moretes.com/blog/busca-de-usuarios-em-cognito-com-escala-e-privacidade/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/busca-de-usuarios-em-cognito-com-escala-e-privacidade/article.md?lang=pt - Category: Security & Resilience - Tags: cognito, opensearch, identity, privacy, api-gateway, lambda, event-driven, financial-grade ### Ransomware Recovery Patterns on AWS: A Technical Review Ransomware remains the highest-financial-impact threat vector in enterprise environments, and AWS provides solid technical primitives to build real resilience. In this analysis, I examine the recovery patterns published by the AWS Architecture Blog through the lens of someone who has operated DR plans in regulated financial environments. The result is an honest view: where these patterns deliver real value, where operational gaps exist, and what you need to add for them to hold under pressure. - HTML: https://fernando.moretes.com/blog/resiliencia-cibernetica-contra-ransomware-na-aws - Markdown EN: https://fernando.moretes.com/blog/resiliencia-cibernetica-contra-ransomware-na-aws/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/resiliencia-cibernetica-contra-ransomware-na-aws/article.md?lang=pt - Category: Security & Resilience - Tags: ransomware, resilience, disaster-recovery, kms, s3-object-lock, aws-backup, security, financial-grade ### Cognito Multi-Region: Migrating Identity to High Availability Authentication is critical infrastructure, a regional Cognito failure brings down the entire user journey. With Cognito multi-Region replication now available, there is a concrete path to elevating the identity plane to the same resilience level we already demand from databases and queues. In this article, I document the migration journey, the architecture decisions, and the risks that need active management. - HTML: https://fernando.moretes.com/blog/cognito-multi-region-autenticacao-resiliente - Markdown EN: https://fernando.moretes.com/blog/cognito-multi-region-autenticacao-resiliente/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/cognito-multi-region-autenticacao-resiliente/article.md?lang=pt - Category: Security & Resilience - Tags: cognito, multi-region, identity, resilience, kms, migration, financial-grade, zero-trust ### ML Observability on EKS: Logs, Metrics and Tracing Head-to-Head ML workloads on EKS generate telemetry volumes that expose the limits of any observability pipeline not designed for that profile. In this article I compare four collection and routing approaches for logs and metrics, focusing on real cost, diagnostic latency and fitness for regulated financial environments. - HTML: https://fernando.moretes.com/blog/observabilidade-para-ml-em-eks-com-logs-metricas-e-custo - Markdown EN: https://fernando.moretes.com/blog/observabilidade-para-ml-em-eks-com-logs-metricas-e-custo/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/observabilidade-para-ml-em-eks-com-logs-metricas-e-custo/article.md?lang=pt - Category: Data Platforms - Tags: eks, mlops, observability, opentelemetry, cloudwatch, fluent-bit, datadog, cost-optimization ### Agentic RAG with OpenSearch Serverless: Anatomy of a Pattern The agentic RAG pattern with OpenSearch Serverless promises elastic scale and semantic retrieval without infrastructure management, but hides serious latency, cost, and consistency pitfalls that financial-grade systems cannot afford to ignore. In this article, I dissect the pattern's anatomy, map when it works, when it fails, and how to configure it with production-grade rigor. - HTML: https://fernando.moretes.com/blog/opensearch-serverless-agentic-rag-escala - Markdown EN: https://fernando.moretes.com/blog/opensearch-serverless-agentic-rag-escala/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/opensearch-serverless-agentic-rag-escala/article.md?lang=pt - Category: AI & Agents - Tags: opensearch, rag, agentic-ai, vector-search, serverless, bedrock, financial-grade, aws ### CloudWatch to OTel: Tearing Down the Observability Bridge Pattern The CloudWatch-to-OpenTelemetry bridge pattern solves a real observability fragmentation problem in multi-platform environments, but it carries operational costs and design pitfalls that rarely surface in tutorials. In this article I tear down the anatomy of this pattern, when it makes sense, and when it creates more problems than it solves. - HTML: https://fernando.moretes.com/blog/cloudwatch-para-opentelemetry-com-lambda-e-guardrails - Markdown EN: https://fernando.moretes.com/blog/cloudwatch-para-opentelemetry-com-lambda-e-guardrails/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/cloudwatch-para-opentelemetry-com-lambda-e-guardrails/article.md?lang=pt - Category: AWS & Cloud - Tags: observability, opentelemetry, cloudwatch, lambda, otel-collector, financial-grade, platform-engineering, aws ### Migrating to Stateful Cloud Native Platforms on AWS EKS Migrating stateful workloads to cloud native platforms is not merely a containerization exercise, it is a sequence of isolation, data consistency, and operational automation decisions that determine whether the platform survives production. In this article, I walk through the journey of a financial-grade platform that moved from manually managed VMs to a multitenant EKS environment with Kubernetes operators, managed persistent storage, and end-to-end observability. - HTML: https://fernando.moretes.com/blog/servicos-stateful-multitenant-com-isolamento-e-automacao - Markdown EN: https://fernando.moretes.com/blog/servicos-stateful-multitenant-com-isolamento-e-automacao/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/servicos-stateful-multitenant-com-isolamento-e-automacao/article.md?lang=pt - Category: AWS & Cloud - Tags: eks, stateful, kubernetes, multitenancy, migration, financial-grade, operators, observability ### One Org or Many? The Postmortem Nobody Wants to Write The choice between a single AWS Organization and multiple organizations looks strategic on paper but becomes operational at the worst possible moment, during an incident. This article reconstructs the most common failure pattern I observe in financial-grade environments and proposes concrete remediations grounded in the AWS Well-Architected pillars. - HTML: https://fernando.moretes.com/blog/aws-organizations-single-ou-multi-org-com-governanca - Markdown EN: https://fernando.moretes.com/blog/aws-organizations-single-ou-multi-org-com-governanca/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/aws-organizations-single-ou-multi-org-com-governanca/article.md?lang=pt - Category: Security & Resilience - Tags: aws-organizations, landing-zone, governance, iam, finops, security, multi-account, scp ### Modern KYC: Serverless, AI and Audit Trails in Financial Services KYC (Know Your Customer) is evolving from an overnight batch process into an event-driven pipeline with AI-assisted decisions and immutable audit trails. This shift is not merely technical, it redefines how solution architects think about compliance, latency and cost in regulated financial environments. In this briefing, I analyze the signal, the emerging patterns and how to position your architecture for this transition. - HTML: https://fernando.moretes.com/blog/kyc-moderno-com-serverless-ia-e-trilha-de-auditoria - Markdown EN: https://fernando.moretes.com/blog/kyc-moderno-com-serverless-ia-e-trilha-de-auditoria/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/kyc-moderno-com-serverless-ia-e-trilha-de-auditoria/article.md?lang=pt - Category: Financial Systems - Tags: kyc, financial-services, serverless, ai, audit, step-functions, bedrock, compliance ### GPT-5 vs Claude vs Nova on Bedrock: A Production Governance Bake-off With GPT-5.5 and Codex landing on Amazon Bedrock, platform teams now face a genuine choice between three frontier model families within the same control plane. This analysis compares GPT-5.5, Claude 3.7 Sonnet, and Amazon Nova Pro through the lens of teams shipping AI into regulated production environments. - HTML: https://fernando.moretes.com/blog/bedrock-2026-governanca-modelos-frontier - Markdown EN: https://fernando.moretes.com/blog/bedrock-2026-governanca-modelos-frontier/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/bedrock-2026-governanca-modelos-frontier/article.md?lang=pt - Category: AI & Agents - Tags: bedrock, gpt-5, claude, nova, ai-governance, llm-ops, financial-grade, aws ### Pixels to Planning: Geospatial Data Platforms on AWS Earth AI platforms are leaving research labs and entering real operational decisions, from climate credit to infrastructure asset management. Architecting this pipeline on AWS requires precise choices about raster/vector ingestion, geospatial partitioning, inference latency, and data lineage. This article documents the decisions I would make today, the anti-patterns I have seen in the field, and the checklist you can act on tomorrow. - HTML: https://fernando.moretes.com/blog/earth-ai-e-planejamento-com-dados-para-decisoes-sustentaveis - Markdown EN: https://fernando.moretes.com/blog/earth-ai-e-planejamento-com-dados-para-decisoes-sustentaveis/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/earth-ai-e-planejamento-com-dados-para-decisoes-sustentaveis/article.md?lang=pt - Category: Data Platforms - Tags: geospatial, earth-ai, data-platform, sustainability, aws, sagemaker, data-mesh, mlops ### Low-Carbon Computing with Retired Devices: A Real-World Edge Architecture Repurposing retired smartphones as edge compute nodes is not just a sustainability bet, it is an architectural decision with serious implications for reliability, security, and operational cost. In this article, I analyze the real mechanisms, failure modes, and engineering trade-offs that separate a lab experiment from a production platform. - HTML: https://fernando.moretes.com/blog/computacao-de-baixo-carbono-com-dispositivos-reutilizados - Markdown EN: https://fernando.moretes.com/blog/computacao-de-baixo-carbono-com-dispositivos-reutilizados/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/computacao-de-baixo-carbono-com-dispositivos-reutilizados/article.md?lang=pt - Category: Solution Architecture - Tags: edge-computing, sustainability, aws-greengrass, iot, low-carbon, fleet-management, observability, financial-grade ### TPU Developer Hub: A Technical Review of a High-Performance AI Platform The TPU Developer Hub consolidates tooling, documentation, and high-performance ML stacks around Google Cloud TPUs. For architects operating in financial-grade environments with latency, cost, and governance demands, understanding where this platform delivers real value, and where it imposes operational friction, is essential before any migration commitment. - HTML: https://fernando.moretes.com/blog/tpu-developer-hub-e-stack-de-ia-com-performance - Markdown EN: https://fernando.moretes.com/blog/tpu-developer-hub-e-stack-de-ia-com-performance/article.md?lang=en - Markdown PT: https://fernando.moretes.com/blog/tpu-developer-hub-e-stack-de-ia-com-performance/article.md?lang=pt - Category: AI & Agents - Tags: tpu, ml-platform, ai-infrastructure, google-cloud, aws-bedrock, financial-ai, performance, cost-optimization ## Architecture Studies ### ADR: S/4HANA in Hong Kong: X2idn Landed, Migrate Now or Wait for X8i? On September 11, 2026 AWS enabled X2idn instances in Asia Pacific (Hong Kong). For a financial core on S/4HANA that cannot leave the region, it is the first 2 TiB Nitro instance certified for production HANA there: 49% more SAPS and 5.7× the EBS bandwidth of x1.32xlarge. This ADR records why I migrate now and accept a second migration to X8i when it arrives. - HTML: https://fernando.moretes.com/studies/adr-s-4hana-em-hong-kong-x2idn-chegou-migrar-agora-ou-esperar-x8i - Markdown PT: https://fernando.moretes.com/studies/adr-s-4hana-em-hong-kong-x2idn-chegou-migrar-agora-ou-esperar-x8i/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-s-4hana-em-hong-kong-x2idn-chegou-migrar-agora-ou-esperar-x8i/study.md?lang=en - Type: adr - Tags: SAP HANA, EC2 X2idn, ADR, ap-east-1, Capacity Reservations, EBS gp3, High Availability, FinOps, adr ### Bedrock Web Search in GovCloud: an ADR on grounding under compliance On September 2, 2026 AWS brought the server-side Web Search tool on Amazon Bedrock to GovCloud (US-West). I wrote this ADR because the real decision is not "web search or no web search", it is which retrieval mode you operate in, and the default of the `external_web_access` parameter pushes regulated teams to exactly the wrong side, with an HTTP 200 and no visible error. - HTML: https://fernando.moretes.com/studies/web-search-do-bedrock-no-govcloud-um-adr-sobre-grounding-regulado - Markdown PT: https://fernando.moretes.com/studies/web-search-do-bedrock-no-govcloud-um-adr-sobre-grounding-regulado/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/web-search-do-bedrock-no-govcloud-um-adr-sobre-grounding-regulado/study.md?lang=en - Type: adr - Tags: bedrock, govcloud, grounding, iam, finops, adr, compliance, observability ### ADR: bringing governed agents into Amazon Quick The Amazon Quick and AWS Agent Registry integration changes the control point: the problem stops being manual MCP setup and becomes governance of a catalog consumable by business users. I would treat this as a platform decision, not a console convenience. - HTML: https://fernando.moretes.com/studies/adr-levar-agentes-governados-para-o-amazon-quick - Markdown PT: https://fernando.moretes.com/studies/adr-levar-agentes-governados-para-o-amazon-quick/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-levar-agentes-governados-para-o-amazon-quick/study.md?lang=en - Type: adr - Tags: AWS, Agent Registry, Amazon Quick, MCP, Bedrock AgentCore, Governance, ADR, Enterprise AI, adr ### Fractional GPU on ECS: Architecture Decision Record for AI Inference Amazon ECS now supports fractional GPU scheduling on EC2 G6f instances, enabling partitions as small as 1/8 of an NVIDIA L4 GPU with 3 GB of memory. For financial-grade AI inference platforms, this fundamentally changes the cost and workload density calculus. This ADR documents the context, options considered, the decision, and real operational consequences. - HTML: https://fernando.moretes.com/studies/adr-gpu-fracionada-no-ecs-decisao-de-arquitetura-para-inferencia-de-ia - Markdown PT: https://fernando.moretes.com/studies/adr-gpu-fracionada-no-ecs-decisao-de-arquitetura-para-inferencia-de-ia/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-gpu-fracionada-no-ecs-decisao-de-arquitetura-para-inferencia-de-ia/study.md?lang=en - Type: adr - Tags: ECS, GPU, AI Inference, G6f, Cost Optimization, ECS Managed Instances, CloudWatch, Financial Grade, adr ### ADR: EKS Provisioned Control Plane and 40x HPA Concurrency EKS Provisioned Control Plane now processes HPA objects with up to 40x more concurrency than the Kubernetes default, eliminating a silent bottleneck in clusters running hundreds of workloads. In this architecture decision record, I analyze the context that makes this change meaningful, the options that existed before it, and the operational consequences architects need to address now. - HTML: https://fernando.moretes.com/studies/adr-eks-provisioned-control-plane-e-hpa-concurrency-40x - Markdown PT: https://fernando.moretes.com/studies/adr-eks-provisioned-control-plane-e-hpa-concurrency-40x/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-eks-provisioned-control-plane-e-hpa-concurrency-40x/study.md?lang=en - Type: adr - Tags: eks, kubernetes, hpa, autoscaling, control-plane, financial-grade, sre, well-architected, adr ### ADR: IAM Role Sessions in GameLift Streams: Eliminating Static Credentials Amazon GameLift Streams added per-session IAM role support in July 2026, eliminating the need for static credentials embedded in application bundles. This article analyzes the architectural decision behind this change, the security patterns it embodies, and the operational consequences for teams building streaming platforms with AWS resource access. - HTML: https://fernando.moretes.com/studies/adr-iam-role-sessions-no-gamelift-streams-eliminando-credenciais-estat - Markdown PT: https://fernando.moretes.com/studies/adr-iam-role-sessions-no-gamelift-streams-eliminando-credenciais-estat/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-iam-role-sessions-no-gamelift-streams-eliminando-credenciais-estat/study.md?lang=en - Type: adr - Tags: IAM, GameLift Streams, Security, Zero Trust, Credential Management, AWS Well-Architected, DevSecOps, Streaming, adr ### SAP LeanIX in Practice: The Architect's Guide: Inventory, Diagrams, and Reports A practical, opinionated tutorial on using SAP LeanIX as a transformation accelerator in the architect's daily work, covering inventory (Fact Sheets, meta model, quality), diagrams (types, when to use, live vs static), and reports (question → data → decision). Uses Hohpe's Architecture Elevator as the connecting thread and a fictional insurer/bank scenario to make every concept concrete. - HTML: https://fernando.moretes.com/studies/sap-leanix-na-pratica-guia-do-arquiteto - Markdown PT: https://fernando.moretes.com/studies/sap-leanix-na-pratica-guia-do-arquiteto/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/sap-leanix-na-pratica-guia-do-arquiteto/study.md?lang=en - Type: tutorial - Tags: enterprise-architecture, leanix, transformation, portfolio-management, diagrams, reports, togaf, architecture-elevator ### ADR: Migrating Financial Workloads to EC2 R8i in Tokyo and Frankfurt The availability of EC2 R8in, R8ib, R8idn, and R8idb instances in Tokyo, Frankfurt, and Ireland opens a real decision window for financial architectures that depend on sub-millisecond network latency, extreme EBS throughput, and data residency compliance. This ADR documents the reasoning behind adopting, or not, these instances for financial-grade workloads. - HTML: https://fernando.moretes.com/studies/adr-migrando-workloads-financeiros-para-ec2-r8i-no-tokyo-e-frankfurt - Markdown PT: https://fernando.moretes.com/studies/adr-migrando-workloads-financeiros-para-ec2-r8i-no-tokyo-e-frankfurt/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-migrando-workloads-financeiros-para-ec2-r8i-no-tokyo-e-frankfurt/study.md?lang=en - Type: adr - Tags: ec2, r8i, financial-grade, adr, msk, eks, nitro, network-performance ### ADR: Scaling Agents to Production with AgentCore Runtime Quotas In July 2026, AWS raised AgentCore Runtime default limits to 5,000 active concurrent sessions in us-east-1/us-west-2 and 200 interactions per second across all regions. This ADR documents the context that forced this design decision, the architectural options I evaluated for financial-grade agentic systems at scale, and the operational consequences you must plan for before putting agents into production. - HTML: https://fernando.moretes.com/studies/adr-escalando-agentes-em-producao-com-agentcore-runtime-quotas - Markdown PT: https://fernando.moretes.com/studies/adr-escalando-agentes-em-producao-com-agentcore-runtime-quotas/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-escalando-agentes-em-producao-com-agentcore-runtime-quotas/study.md?lang=en - Type: adr - Tags: bedrock-agentcore, agentic-ai, quota-management, financial-grade, aws-well-architected, session-scaling, observability, enterprise-ai, adr ### Loop Engineering: designing the loops that guide AI agents The bottleneck in AI agents has shifted from the prompt sentence to the loop design: trigger, topology, verifier, and stop rules. This guide teaches loop engineering fundamentals, from the base ReAct loop to a pattern catalogue, with real examples from my own system and a step-by-step guide for engineering any loop safely. - HTML: https://fernando.moretes.com/studies/loop-engineering-agentes-de-ia - Markdown PT: https://fernando.moretes.com/studies/loop-engineering-agentes-de-ia/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/loop-engineering-agentes-de-ia/study.md?lang=en - Type: guide - Tags: loop-engineering, ai-agents, ReAct, agentic-systems, LLM, orchestration, bedrock, stop-rules ### Lambda vs ECS: the architect's compute decision guide on AWS Choosing between Lambda and ECS is not about preference, it is about matching the unit of scale to the load pattern. This guide covers every Lambda type (including MicroVMs and Managed Instances) and ECS type (Fargate, EC2, Managed Instances), the decision framework I use in practice, and the real impact on engineering, business, and customer experience. - HTML: https://fernando.moretes.com/studies/lambda-vs-ecs-quando-usar - Markdown PT: https://fernando.moretes.com/studies/lambda-vs-ecs-quando-usar/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/lambda-vs-ecs-quando-usar/study.md?lang=en - Type: guide - Tags: aws, lambda, ecs, fargate, serverless, containers, compute, architecture ### Playbook: 5 AI Architecture Shifts, and what to do about each one What was advanced in 2025 became default in 2026: the bottleneck moved past the prompt, agents went to managed production, MCP standardized tooling, security became layered, and token FinOps entered the roadmap. This playbook maps each shift to concrete actions, for people building systems, not demos. - HTML: https://fernando.moretes.com/studies/playbook-5-mudancas-em-arquitetura-de-ia-2026 - Markdown PT: https://fernando.moretes.com/studies/playbook-5-mudancas-em-arquitetura-de-ia-2026/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-5-mudancas-em-arquitetura-de-ia-2026/study.md?lang=en - Type: playbook - Tags: aws, bedrock, agents, mcp, genai, finops, security, architecture ### Inside AI Agents (1/3): Anatomy and the Reasoning Loop A technical lesson for developers and architects who hear 'AI agent' every day but want to truly understand what differentiates an agent from a plain LLM, a fixed pipeline, or simple RAG. We cover the full anatomy, model, tools, memory, planner, and the ReAct loop step by step with a concrete example. No hype; real trade-offs. - HTML: https://fernando.moretes.com/studies/agentes-de-ia-por-dentro-1-o-que-e-um-agente - Markdown PT: https://fernando.moretes.com/studies/agentes-de-ia-por-dentro-1-o-que-e-um-agente/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/agentes-de-ia-por-dentro-1-o-que-e-um-agente/study.md?lang=en - Type: guide - Tags: ai-agents, llm, react-loop, function-calling, architecture, bedrock, foundational, series ### Inside AI Agents (2/3): Architecture Pattern Catalog, from ReAct to Multi-Agent The second lesson in the series maps the full catalog of AI agent architecture patterns: from single-agent loops (ReAct, Reflexion, Plan-and-Execute) to multi-agent orchestration, covering memory as an architecture decision, guardrails, and human-in-the-loop. The goal is to give the architect a precise vocabulary to choose, and justify, the right pattern for each problem, without falling into classic anti-patterns. - HTML: https://fernando.moretes.com/studies/agentes-de-ia-por-dentro-2-padroes-de-arquitetura - Markdown PT: https://fernando.moretes.com/studies/agentes-de-ia-por-dentro-2-padroes-de-arquitetura/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/agentes-de-ia-por-dentro-2-padroes-de-arquitetura/study.md?lang=en - Type: guide - Tags: ai-agents, ReAct, multi-agent, memory, guardrails, orchestration, LLM, architecture-patterns ### Inside AI Agents (3/3): Agents in Production on AWS with Bedrock AgentCore The third and final part of the series descends the elevator to the technical floor: how to run an AI agent in production on AWS using Amazon Bedrock AgentCore. We cover the full component map (Runtime, Gateway, Memory, Identity, Observability), model selection by cost/latency/reasoning, security with guardrails and session isolation, and FinOps to keep real costs under a few dollars per month. - HTML: https://fernando.moretes.com/studies/agentes-de-ia-por-dentro-3-em-producao-na-aws - Markdown PT: https://fernando.moretes.com/studies/agentes-de-ia-por-dentro-3-em-producao-na-aws/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/agentes-de-ia-por-dentro-3-em-producao-na-aws/study.md?lang=en - Type: guide - Tags: bedrock, agentcore, aws, ai-agents, serverless, finops, mcp, observability ### ADR: Automated Policy Refinement in Bedrock Guardrails The new iterative refinement and ambiguity reduction workflows in Bedrock Guardrails Automated Reasoning checks reduce the manual burden of maintaining formal policies, but introduce non-trivial architectural decisions around governance, policy lifecycle, and CI/CD pipeline integration. In this ADR, I analyze the context, options considered, and real consequences of this decision in regulated financial environments. - HTML: https://fernando.moretes.com/studies/adr-bedrock-guardrails-policy-refinement - Markdown PT: https://fernando.moretes.com/studies/adr-bedrock-guardrails-policy-refinement/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-bedrock-guardrails-policy-refinement/study.md?lang=en - Type: adr - Tags: bedrock, guardrails, automated-reasoning, financial-grade, ai-governance, policy-lifecycle, devSecOps, compliance, adr ### ADR: Running AI-Generated Code: Lambda MicroVMs vs. Isolated Containers Architecture decision on how to safely execute AI-agent-generated or user-submitted code in a multi-tenant environment, comparing Lambda MicroVMs (AWS launch June 2026), ephemeral containers with gVisor/Firecracker on ECS/EKS, and standard Lambda. The recommended decision is per-session Lambda MicroVMs orchestrated by Bedrock AgentCore, providing VM-level isolation without the operational overhead of managing your own virtualization stack. - HTML: https://fernando.moretes.com/studies/adr-codigo-de-ia-com-lambda-microvms - Markdown PT: https://fernando.moretes.com/studies/adr-codigo-de-ia-com-lambda-microvms/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-codigo-de-ia-com-lambda-microvms/study.md?lang=en - Type: adr - Tags: serverless, ai-agents, security, lambda, bedrock, multi-tenant, isolation, adr ### ADR: Nextflow Profiles on HealthOmics: Separating Config from Logic AWS HealthOmics now supports Nextflow profiles, enabling predefined execution settings to be activated at runtime without modifying workflow source code. This analysis examines the architectural decision behind that separation of concerns, its real trade-offs, and the operational consequences for teams running bioinformatics pipelines at scale. - HTML: https://fernando.moretes.com/studies/adr-nextflow-profiles-healthomics - Markdown PT: https://fernando.moretes.com/studies/adr-nextflow-profiles-healthomics/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-nextflow-profiles-healthomics/study.md?lang=en - Type: adr - Tags: healthomics, nextflow, bioinformatics, workflow, configuration-management, nf-core, hipaa, aws, adr ### Secure Multi-Tenant RAG: ADR for Two-Layer Authorization Authorization in multi-tenant RAG is not an implementation detail, it is an architectural decision with direct consequences for compliance, cross-tenant data leakage, and LLM attack surface. In this ADR, I document the forces that led me to adopt a defense-in-depth pattern with Amazon Verified Permissions and Bedrock Knowledge Bases, the alternatives I discarded, and the operational consequences that must be managed. - HTML: https://fernando.moretes.com/studies/rag-multi-tenant-seguro-adr-para-autorizacao-em-duas-camadas - Markdown PT: https://fernando.moretes.com/studies/rag-multi-tenant-seguro-adr-para-autorizacao-em-duas-camadas/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/rag-multi-tenant-seguro-adr-para-autorizacao-em-duas-camadas/study.md?lang=en - Type: adr - Tags: RAG, multi-tenant, Amazon Bedrock, Verified Permissions, Zero Trust, authorization, financial-grade, security, adr ### Inside a Bank (1/3): how a bank works, business view and the architecture elevator First lesson in a three-part series for developers and architects moving into financial services. Covers what a bank is, why it exists, how money becomes product, and how the architect uses Gregor Hohpe's 'elevator' to move between the business floor and the technical floor. Brazil/BACEN focus. - HTML: https://fernando.moretes.com/studies/banco-por-dentro-1-como-um-banco-funciona - Markdown PT: https://fernando.moretes.com/studies/banco-por-dentro-1-como-um-banco-funciona/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/banco-por-dentro-1-como-um-banco-funciona/study.md?lang=en - Type: guide - Tags: banking, architecture-elevator, financial-services, bacen, payments, capability-map, brazil, didactic ### Inside a Bank (2/3): the rails and the rules, payments, BACEN and bank × fintech Lesson 2 of 3 in the 'Inside a Bank' series: explains how money moves between institutions in Brazil (SPB, Pix, TED, card, boleto, FX, investments), what the Central Bank requires to operate, and what changes when you are a fintech rather than a fully licensed bank. Maximum didactics for engineers and architects coming from tech. - HTML: https://fernando.moretes.com/studies/banco-por-dentro-2-trilhos-e-regulacao - Markdown PT: https://fernando.moretes.com/studies/banco-por-dentro-2-trilhos-e-regulacao/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/banco-por-dentro-2-trilhos-e-regulacao/study.md?lang=en - Type: guide - Tags: payments, SPB, Pix, BACEN, fintech, banking, Brazil, financial-architecture ### Inside a Bank (3/3): The System Architecture of a Bank The third part of the 'Inside a Bank' series descends the elevator to the technical floor: it explains the double-entry ledger, the engines that compose a core banking system, why idempotency is the central problem in money movement, and how resilience and security work when a bug means real financial loss. For developers and architects moving into financial services. - HTML: https://fernando.moretes.com/studies/banco-por-dentro-3-arquitetura-de-sistemas - Markdown PT: https://fernando.moretes.com/studies/banco-por-dentro-3-arquitetura-de-sistemas/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/banco-por-dentro-3-arquitetura-de-sistemas/study.md?lang=en - Type: guide - Tags: core-banking, ledger, idempotency, event-sourcing, financial-architecture, bacen, hsm, settlement ### AWS us-east-1 (2025): Datacenter Thermal Event Takes Down EC2 and EBS A cooling system failure in an us-east-1 datacenter caused servers to overheat, triggering thermal protection shutdowns that degraded EC2 and EBS across the region. The incident reignites critical debates about workload concentration in us-east-1, the role of physical AZ isolation, and the need for graceful degradation in production architectures. - HTML: https://fernando.moretes.com/studies/aws-us-east-1-thermal-2026 - Markdown PT: https://fernando.moretes.com/studies/aws-us-east-1-thermal-2026/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/aws-us-east-1-thermal-2026/study.md?lang=en - Type: postmortem - Tags: aws, us-east-1, resiliencia, ec2, ebs, postmortem, thermal-event, multi-region ### ADR: Replacing SMS OTP with Silent Authentication in Cognito SMS OTP is simultaneously the most widely deployed authentication mechanism and one of the weakest: vulnerable to SIM swap, SS7 interception, and social engineering, with only ~80% completion rates. This ADR examines the decision to replace or complement SMS OTP with network-silent authentication via Vonage integrated into Amazon Cognito's CUSTOM_AUTH flow. - HTML: https://fernando.moretes.com/studies/adr-substituindo-sms-otp-por-autenticacao-silenciosa-no-cognito - Markdown PT: https://fernando.moretes.com/studies/adr-substituindo-sms-otp-por-autenticacao-silenciosa-no-cognito/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-substituindo-sms-otp-por-autenticacao-silenciosa-no-cognito/study.md?lang=en - Type: adr - Tags: amazon-cognito, authentication, fraud-prevention, custom-auth, sms-otp, zero-trust, ciam, financial-grade, adr ### OIDC Session Metadata and Zero Trust: An Architecture Decision Record Session metadata support in Sign in with Google opens a genuine window for continuous, signal-driven adaptive access, not just at login time. In this ADR, I analyze the architectural forces, options considered, and the decision I would make in a high-criticality financial system integrated with AWS. - HTML: https://fernando.moretes.com/studies/adr-oidc-session-metadata-e-acesso-adaptativo - Markdown PT: https://fernando.moretes.com/studies/adr-oidc-session-metadata-e-acesso-adaptativo/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-oidc-session-metadata-e-acesso-adaptativo/study.md?lang=en - Type: adr - Tags: oidc, zero-trust, cognito, identity, step-up-auth, session-metadata, lambda-authorizer, financial-grade, adr ### Teardown: Resilient Network Graphs and the Next-Generation AI Network An in-depth architectural analysis of the resilient graph-based data center networks AWS is building to support AI workloads at scale, covering topology, congestion control, energy efficiency, and the trade-offs that define the next generation of cloud infrastructure. - HTML: https://fernando.moretes.com/studies/teardown-resilient-network-graphs-ai-data-center - Markdown PT: https://fernando.moretes.com/studies/teardown-resilient-network-graphs-ai-data-center/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/teardown-resilient-network-graphs-ai-data-center/study.md?lang=en - Type: teardown - Tags: networking, AI infrastructure, data center, graph topology, distributed training, sustainability, AWS, congestion control ### ADR: AWS Transform & AI Agents vs Traditional Modernization Factory This ADR evaluates the decision to adopt AWS Transform (with AI agents for .NET, Mainframe, VMware, and custom code) versus a traditional human-engineering modernization factory, or a hybrid approach. The analysis covers regression risk, test coverage, code ownership, security, total cost, and change governance in an enterprise-scale modernization program. - HTML: https://fernando.moretes.com/studies/adr-aws-transform-ai-modernization-vs-traditional-modernization - Markdown PT: https://fernando.moretes.com/studies/adr-aws-transform-ai-modernization-vs-traditional-modernization/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-aws-transform-ai-modernization-vs-traditional-modernization/study.md?lang=en - Type: adr - Tags: modernization, aws-transform, adr, ai-agents, mainframe, dotnet, migration, governance ### Design Doc: Continuous Evaluation Suite for Agents with Bedrock AgentCore LLM agents in production silently degrade as models, tools, and prompts evolve, without a continuous evaluation discipline, regressions reach users before they are detected. This document proposes a complete offline and online evaluation architecture using Amazon Bedrock AgentCore, with versioned datasets, CI/CD quality gates, runtime signals, and systematic adversarial testing. - HTML: https://fernando.moretes.com/studies/design-doc-bedrock-agentcore-evaluation-datasets - Markdown PT: https://fernando.moretes.com/studies/design-doc-bedrock-agentcore-evaluation-datasets/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-bedrock-agentcore-evaluation-datasets/study.md?lang=en - Type: design-doc - Tags: bedrock-agentcore, llm-evaluation, agent-quality, ci-cd, adversarial-testing, tool-use-metrics, mlops, aws ### Design Doc: LLM Observability, from GPU Utilization to Response Quality This document proposes an end-to-end observability architecture for LLM inference platforms running on Amazon SageMaker AI and Amazon Bedrock, covering everything from hardware metrics (GPU utilization, memory) to semantic response quality, behavioral drift, and per-tenant cost. The design integrates CloudWatch, Amazon Managed Grafana, prompt-level tracing, and automated regression alarms, with clear separation of concerns across collection, storage, evaluation, and alerting layers. - HTML: https://fernando.moretes.com/studies/design-doc-llm-observability-quality-cost-sagemaker-bedrock - Markdown PT: https://fernando.moretes.com/studies/design-doc-llm-observability-quality-cost-sagemaker-bedrock/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-llm-observability-quality-cost-sagemaker-bedrock/study.md?lang=en - Type: design-doc - Tags: llm-observability, sagemaker, bedrock, cloudwatch, grafana, mlops, gpu-metrics, eval-driven-ops ### ADR: Cognito Multi-Region for Resilient Authentication This ADR examines when and how to adopt multi-region User Pool replication in Amazon Cognito to reduce authentication downtime on identity platforms with high-availability requirements. It covers regional failover, customer-managed KMS keys, user synchronization, session and token impact, custom domains, and customer experience, with explicit reasoning on operational and cost trade-offs. - HTML: https://fernando.moretes.com/studies/adr-cognito-multiregion-authentication-resilience - Markdown PT: https://fernando.moretes.com/studies/adr-cognito-multiregion-authentication-resilience/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-cognito-multiregion-authentication-resilience/study.md?lang=en - Type: adr - Tags: cognito, multi-region, identity, resilience, kms, failover, authentication, aws ### ADR: OpenSearch Serverless vs Dedicated Vector Database for Agentic RAG This ADR evaluates vector search infrastructure options for a multi-tenant agentic RAG platform on AWS, comparing OpenSearch Serverless, dedicated vector databases (Pinecone, pgvector), and a self-managed hybrid search layer. The decision weighs cost, p99 latency, permission-based filtering, incremental ingestion, and native Bedrock Knowledge Bases integration. - HTML: https://fernando.moretes.com/studies/adr-opensearch-serverless-vs-vector-db-agentic-rag - Markdown PT: https://fernando.moretes.com/studies/adr-opensearch-serverless-vs-vector-db-agentic-rag/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-opensearch-serverless-vs-vector-db-agentic-rag/study.md?lang=en - Type: adr - Tags: rag, opensearch-serverless, vector-search, bedrock, multi-tenancy, agentic-ai, aws, data-platform ### Design Doc: SRE Journey with GenAI using AWS Resilience Hub This document proposes an SRE platform built on AWS Resilience Hub with a GenAI layer to automate dependency discovery, failure mode analysis, and runbook generation for critical applications. The goal is to reduce operational risk through modular resiliency policies and organization-level consolidated reports, replacing manual processes prone to coverage gaps. The design prioritizes traceability, incremental automation, and integration with existing CI/CD pipelines. - HTML: https://fernando.moretes.com/studies/design-doc-resilience-hub-genai-sre-journey - Markdown PT: https://fernando.moretes.com/studies/design-doc-resilience-hub-genai-sre-journey/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-resilience-hub-genai-sre-journey/study.md?lang=en - Type: design-doc - Tags: sre, aws-resilience-hub, genai, resiliency, failure-mode-analysis, runbooks, well-architected, operational-risk ### Design Doc: Enterprise Agentic Automation Layer with Amazon Q, MCP, and Bedrock This document proposes an agentic automation architecture for backoffice, support, and IT operations, connecting Amazon Q Business, the Model Context Protocol (MCP), internal tools, and Amazon Bedrock into a unified layer with mandatory human approval, immutable audit trail, and explicit action boundaries. The goal is to reduce repetitive manual work without sacrificing control, traceability, and security in regulated environments. - HTML: https://fernando.moretes.com/studies/design-doc-amazon-quick-mcp-workflows-enterprise - Markdown PT: https://fernando.moretes.com/studies/design-doc-amazon-quick-mcp-workflows-enterprise/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-amazon-quick-mcp-workflows-enterprise/study.md?lang=en - Type: design-doc - Tags: agentic-ai, amazon-q, bedrock, mcp, workflow-automation, human-in-the-loop, enterprise, event-driven ### Design Doc: Frontier Model Governance on Bedrock with GPT, Claude, and Nova This document proposes an AI Gateway architecture to orchestrate and govern multiple frontier models: OpenAI GPT-5.5/GPT-4.5, Anthropic Claude, Amazon Nova, and specialized models, within Amazon Bedrock. The design covers intelligent routing, guardrails, prompt registry, inference logging, per-tenant IAM, data residency, and fallback policy, with a focus on auditability and cost control in enterprise environments. - HTML: https://fernando.moretes.com/studies/design-doc-bedrock-openai-frontier-model-governance - Markdown PT: https://fernando.moretes.com/studies/design-doc-bedrock-openai-frontier-model-governance/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-bedrock-openai-frontier-model-governance/study.md?lang=en - Type: design-doc - Tags: bedrock, ai-gateway, guardrails, multi-model, governance, iam, data-residency, llmops ### EC2 G7e: Architecture Decision for Generative Video Inference EC2 G7e instances arrive with NVIDIA L40S GPUs and promise to redefine cost-per-frame for generative video inference workloads. In this architecture decision record, I evaluate the forces that make this choice non-trivial, the failure patterns I have seen in production, and the configuration I would adopt in a financial-grade environment. - HTML: https://fernando.moretes.com/studies/adr-inferencia-de-video-com-ia-generativa-e-gpus-na-aws - Markdown PT: https://fernando.moretes.com/studies/adr-inferencia-de-video-com-ia-generativa-e-gpus-na-aws/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-inferencia-de-video-com-ia-generativa-e-gpus-na-aws/study.md?lang=en - Type: adr - Tags: ec2-g7e, gpu-inference, generative-ai, video-processing, eks, bedrock, cost-optimization, financial-grade, adr ### Azure (2026): GenAI Workload Overload and the Shared Blast Radius On May 29, 2026, Microsoft Azure experienced an availability incident tied to shared routing infrastructure saturated by first-party generative AI workloads. The event exposed the classic noisy neighbor risk at hyperscale and led Microsoft to migrate its own GenAI loads to dedicated routing planes. This analysis reconstructs the incident, evaluates the architectural decisions involved, and extracts lessons applicable to any platform hosting LLM inference on multi-tenant infrastructure. - HTML: https://fernando.moretes.com/studies/azure-genai-overload-2026 - Markdown PT: https://fernando.moretes.com/studies/azure-genai-overload-2026/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/azure-genai-overload-2026/study.md?lang=en - Type: postmortem - Tags: azure, genai, resiliencia, noisy-neighbor, capacity-planning, incident, blast-radius, inferencia ### ADR: Adopting Amazon Bedrock AgentCore in Production Bedrock AgentCore promises to reduce the operational friction of running AI agents in production, but adopting any managed agent orchestration platform demands an explicit architectural decision. In this ADR, I document the forces that drove me to evaluate AgentCore, the alternatives considered, and the real consequences of each path. - HTML: https://fernando.moretes.com/studies/adr-agentes-producao-bedrock-agentcore-risco-operacional - Markdown PT: https://fernando.moretes.com/studies/adr-agentes-producao-bedrock-agentcore-risco-operacional/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-agentes-producao-bedrock-agentcore-risco-operacional/study.md?lang=en - Type: adr - Tags: bedrock, agentcore, ai-agents, adr, financial-grade, guardrails, observability, aws ### Coinbase (2026): The AWS MSK Control Plane That Froze Trading On May 7, 2026, a defect in the Amazon MSK control plane prevented automatic partition leader re-election across two of Coinbase's managed Kafka clusters, silently blocking fee, quoting, and trade execution services for hours. The incident exposes the hidden risks of relying on managed services as single coordination points, and the critical need for deep observability into infrastructure you don't operate. - HTML: https://fernando.moretes.com/studies/coinbase-aws-msk-2026 - Markdown PT: https://fernando.moretes.com/studies/coinbase-aws-msk-2026/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/coinbase-aws-msk-2026/study.md?lang=en - Type: postmortem - Tags: postmortem, kafka, aws-msk, resilience, coinbase, event-driven, observability, managed-services ### DENIC .de (2026): Broken DNSSEC Signatures and the Collapse of the Trust Chain On May 5, 2026, DENIC published invalid DNSSEC signatures for the .de TLD, rendering millions of German domains unreachable for resolvers with DNSSEC validation enabled. The incident exposed structural weaknesses in key management, the absence of canary validation before publishing signed zones, and the fundamental trade-off between cryptographic security and operational availability. - HTML: https://fernando.moretes.com/studies/denic-de-dnssec-2026 - Markdown PT: https://fernando.moretes.com/studies/denic-de-dnssec-2026/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/denic-de-dnssec-2026/study.md?lang=en - Type: postmortem - Tags: dnssec, dns, tld, incident, postmortem, key-management, availability, trust-chain ### Teardown: Frontier Agents for Security and DevOps on AWS An in-depth technical analysis of AWS's frontier agent architecture for on-demand penetration testing and cloud operations incident resolution. We examine isolation, action scope, human approval gates, rollback mechanisms, and the real operational risks that emerge when you put an LLM in the infrastructure control loop. - HTML: https://fernando.moretes.com/studies/teardown-frontier-agents-security-devops - Markdown PT: https://fernando.moretes.com/studies/teardown-frontier-agents-security-devops/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/teardown-frontier-agents-security-devops/study.md?lang=en - Type: teardown - Tags: agents, bedrock, security, devops, aws, llm-ops, autonomy, pentest ### Playbook: GenAI FinOps: Cutting Agent Cost Without Losing Quality GenAI agents in production accumulate cost in places standard dashboards don't surface: bloated input tokens, loops without stop criteria, silent retries, and expensive models on trivial tasks. This playbook presents six optimization levers, with execution order, impact table, and the anti-patterns that turn savings into quality regressions. - HTML: https://fernando.moretes.com/studies/playbook-finops-de-genai-cortar-custo-de-agente - Markdown PT: https://fernando.moretes.com/studies/playbook-finops-de-genai-cortar-custo-de-agente/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-finops-de-genai-cortar-custo-de-agente/study.md?lang=en - Type: playbook - Tags: finops, genai, bedrock, agents, cost-optimization, llm, prompt-engineering, aws ### Design Doc: EKS Multi-Tenant at Scale: Karpenter, Isolation, and Cost This document describes the architecture of a multi-tenant EKS platform for dozens of teams, covering workload isolation via namespaces, network policies, and RBAC, autoscaling and consolidation with Karpenter using Spot instances, and per-tenant cost allocation via Kubecost. The goal is to operate with security, cost predictability, and infrastructure efficiency without sacrificing team autonomy. - HTML: https://fernando.moretes.com/studies/design-doc-eks-multitenant-em-escala - Markdown PT: https://fernando.moretes.com/studies/design-doc-eks-multitenant-em-escala/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-eks-multitenant-em-escala/study.md?lang=en - Type: design-doc - Tags: eks, kubernetes, multi-tenant, karpenter, spot, kubecost, irsa, cost-optimization ### Design Doc: Multi-Agent Orchestration with Amazon Bedrock and Step Functions This document proposes a multi-agent orchestration architecture using Amazon Bedrock Agents in a supervisor/worker topology, with Step Functions managing state, retries, and human-in-the-loop. The focus is on separating reasoning responsibilities (LLM) from orchestration responsibilities (state flow), applying security guardrails, and controlling operational cost deterministically. - HTML: https://fernando.moretes.com/studies/design-doc-orquestracao-multi-agente-bedrock - Markdown PT: https://fernando.moretes.com/studies/design-doc-orquestracao-multi-agente-bedrock/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-orquestracao-multi-agente-bedrock/study.md?lang=en - Type: design-doc - Tags: bedrock, step-functions, multi-agent, orchestration, guardrails, human-in-the-loop, event-driven, ai ### ADR: Self-Hosted LLM (EKS + vLLM) vs Managed API (Bedrock) This ADR evaluates the decision between self-hosting large language models on EKS with vLLM versus consuming models via Amazon Bedrock. The analysis covers cost per token, MLOps operational burden, cold start, data residency, and token-volume break-even point. - HTML: https://fernando.moretes.com/studies/adr-llm-self-hosted-eks-vs-bedrock - Markdown PT: https://fernando.moretes.com/studies/adr-llm-self-hosted-eks-vs-bedrock/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-llm-self-hosted-eks-vs-bedrock/study.md?lang=en - Type: adr - Tags: llm, bedrock, vllm, eks, gpu, mlops, cost-optimization, ai-platform ### ADR: Model Selection on Amazon Bedrock: Claude vs Nova vs Llama vs Fine-tune Architectural decision on which foundation model to adopt for an enterprise GenAI feature on Amazon Bedrock, evaluating quality, cost per token, latency, data governance, pt-BR support, and context window. The conclusion is a task-type routing strategy, no single model wins across all axes. - HTML: https://fernando.moretes.com/studies/adr-selecao-de-modelo-no-bedrock - Markdown PT: https://fernando.moretes.com/studies/adr-selecao-de-modelo-no-bedrock/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-selecao-de-modelo-no-bedrock/study.md?lang=en - Type: adr - Tags: bedrock, llm, model-selection, genai, aws, cost-optimization, pt-BR, adr ### Design Doc: Production Agents with Amazon Bedrock AgentCore This document describes the architecture of a production AI agent platform using Amazon Bedrock AgentCore, covering serverless runtime with session isolation, tool governance via Gateway/MCP, short- and long-term memory, federated identity, and observability. The focus is on operational guardrails, cost ceilings, and tool governance, the problems that actually sink agent projects in enterprise environments. - HTML: https://fernando.moretes.com/studies/design-doc-bedrock-agentcore-agentes-em-producao - Markdown PT: https://fernando.moretes.com/studies/design-doc-bedrock-agentcore-agentes-em-producao/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-bedrock-agentcore-agentes-em-producao/study.md?lang=en - Type: design-doc - Tags: bedrock, agentcore, ai-agents, aws, serverless, observability, guardrails, mcp ### Cloudflare (2026): when a single-AZ dependency takes down an 'HA' cluster On February 20, 2026, Cloudflare experienced a control plane and analytics outage because Kafka and ClickHouse, critical data ingestion and query services, existed only in zone PDX-04, while the cluster declared as highly available depended on them implicitly. The incident exposes a recurring pattern in distributed systems: the illusion of HA created by partial redundancy that does not cover the full dependency chain. - HTML: https://fernando.moretes.com/studies/cloudflare-single-az-2026 - Markdown PT: https://fernando.moretes.com/studies/cloudflare-single-az-2026/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/cloudflare-single-az-2026/study.md?lang=en - Type: postmortem - Tags: postmortem, cloudflare, single-az, kafka, clickhouse, resiliência, observabilidade, dependências ocultas ### ADR: Aurora Sharding: App-Level vs Aurora Limitless vs Citus A high-growth OLTP workload exhausted the capacity of a single Aurora PostgreSQL writer. This ADR evaluates three sharding strategies, application-layer sharding, Aurora Limitless Database, and managed Citus/PostgreSQL, weighing operational complexity, cost, cross-shard query support, and migration risk. - HTML: https://fernando.moretes.com/studies/adr-aurora-sharding-limitless-vs-app-level - Markdown PT: https://fernando.moretes.com/studies/adr-aurora-sharding-limitless-vs-app-level/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-aurora-sharding-limitless-vs-app-level/study.md?lang=en - Type: adr - Tags: aurora, sharding, postgresql, oltp, aurora-limitless, citus, data-platform, scalability ### Design Doc: RDS Proxy for Lambda + RDS Without Melting the Database Lambda functions under high concurrency open hundreds of direct connections to RDS, exhausting the pool and crashing the database. This document proposes RDS Proxy as a multiplexing layer, details real pinning pitfalls, compares alternatives such as Data API and application-side poolers, and defines when Proxy is not the right answer. - HTML: https://fernando.moretes.com/studies/design-doc-rds-proxy-pooling-serverless - Markdown PT: https://fernando.moretes.com/studies/design-doc-rds-proxy-pooling-serverless/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-rds-proxy-pooling-serverless/study.md?lang=en - Type: design-doc - Tags: rds-proxy, lambda, serverless, connection-pooling, aws-rds, data-platform, iam-auth, postgresql ### Design Doc: Zero Trust on AWS for Internal Service Access This document proposes a Zero Trust architecture on AWS where identity, context, and device posture replace the network perimeter as the primary access control mechanism. The design covers workload segmentation, adaptive access via IAM Identity Center and Verified Access, and continuous audit instrumentation. The goal is to eliminate implicit trust based on network location without introducing excessive operational friction. - HTML: https://fernando.moretes.com/studies/design-doc-zero-trust-on-aws - Markdown PT: https://fernando.moretes.com/studies/design-doc-zero-trust-on-aws/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-zero-trust-on-aws/study.md?lang=en - Type: design-doc - Tags: zero-trust, aws, iam, security, identity, segmentation, access-control, compliance ### Playbook: Which AWS AI Service to Use: The Decision Tree Bedrock, SageMaker, Amazon Q, AgentCore, and self-hosted GPU solve different problems, but hype pushes everyone toward Bedrock by default. This playbook delivers a decision tree, a trade-off matrix, and rules of thumb so you choose by the problem, not the trend. - HTML: https://fernando.moretes.com/studies/playbook-qual-servico-de-ia-da-aws-usar - Markdown PT: https://fernando.moretes.com/studies/playbook-qual-servico-de-ia-da-aws-usar/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-qual-servico-de-ia-da-aws-usar/study.md?lang=en - Type: playbook - Tags: aws, bedrock, sagemaker, amazon-q, agentcore, genai, decision-tree, architecture ### Design Doc: Enterprise RAG Platform with Continuous Evaluation and Guardrails on Bedrock This document describes the architecture of an enterprise RAG platform built on Amazon Bedrock, covering semantic retrieval, continuous quality evaluation, safety guardrails, and cost control. The design prioritizes traceability, operability, and risk containment in regulated environments, without sacrificing acceptable end-user latency. - HTML: https://fernando.moretes.com/studies/design-doc-enterprise-rag-guardrails - Markdown PT: https://fernando.moretes.com/studies/design-doc-enterprise-rag-guardrails/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-enterprise-rag-guardrails/study.md?lang=en - Type: design-doc - Tags: RAG, Bedrock, guardrails, evaluation, enterprise-ai, AWS, cost-control, security ### Design Doc: Multi-Region Active-Active Payments API This document proposes a multi-region active-active architecture for a critical payments API, targeting near-zero RTO/RPO, deterministic conflict resolution in data replication, and a phased rollout that minimizes operational risk. The design is grounded in real financial engineering principles and AWS patterns, with explicit trade-offs between consistency, latency, and cost. - HTML: https://fernando.moretes.com/studies/design-doc-multiregion-active-active-payments - Markdown PT: https://fernando.moretes.com/studies/design-doc-multiregion-active-active-payments/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/design-doc-multiregion-active-active-payments/study.md?lang=en - Type: design-doc - Tags: multi-region, active-active, payments, resilience, rto-rpo, conflict-resolution, aws, data-replication ### ADR: EventBridge vs Kafka/MSK for Order Processing This ADR evaluates EventBridge and Amazon MSK as the event backbone for an order processing system, weighing throughput, ordering, replay, and operational burden. The decision is grounded in real trade-offs between managed simplicity and platform control, with direct consequences on cost, operability, and delivery guarantees. - HTML: https://fernando.moretes.com/studies/adr-event-driven-eventbridge-vs-kafka - Markdown PT: https://fernando.moretes.com/studies/adr-event-driven-eventbridge-vs-kafka/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-event-driven-eventbridge-vs-kafka/study.md?lang=en - Type: adr - Tags: event-driven, eventbridge, kafka, msk, order-processing, adr, aws, messaging ### Playbook: How to Harden an AI Agent: The Defense Layers AI agents expose attack surfaces that traditional firewalls don't cover: prompt injection, exfiltration via tool calls, uncontrolled output. This playbook describes the four defense layers, edge, content, tools, and output, what each one blocks, where it fails, and how to compose them without useless redundancy. - HTML: https://fernando.moretes.com/studies/playbook-blindar-agente-de-ia-camadas-de-defesa - Markdown PT: https://fernando.moretes.com/studies/playbook-blindar-agente-de-ia-camadas-de-defesa/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-blindar-agente-de-ia-camadas-de-defesa/study.md?lang=en - Type: playbook - Tags: agentic-ai, security, bedrock, guardrails, waf, iam, prompt-injection, defense-in-depth ### ADR: Aurora vs DynamoDB for a Double-Entry Ledger in Core Banking This ADR evaluates Aurora PostgreSQL and DynamoDB as the persistence engine for a double-entry ledger in a core banking system, weighing strong consistency, access patterns, auditability, and cost. The decision favors Aurora with date-range partitioning and an immutable event layer, acknowledging the horizontal scaling constraints that choice imposes. - HTML: https://fernando.moretes.com/studies/adr-aurora-vs-dynamodb-ledger - Markdown PT: https://fernando.moretes.com/studies/adr-aurora-vs-dynamodb-ledger/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-aurora-vs-dynamodb-ledger/study.md?lang=en - Type: adr - Tags: aurora, dynamodb, ledger, core-banking, double-entry, consistency, data-platform, adr ### ADR: Modular Monolith vs Microservices in a Greenfield Fintech An early-stage fintech faces the classic architecture decision: go straight to microservices or build a modular monolith first. This ADR examines the real forces at play, team size, validation speed, blast radius, and operational cost, and records the decision with its concrete consequences. - HTML: https://fernando.moretes.com/studies/adr-monolito-modular-vs-microservices-fintech - Markdown PT: https://fernando.moretes.com/studies/adr-monolito-modular-vs-microservices-fintech/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/adr-monolito-modular-vs-microservices-fintech/study.md?lang=en - Type: adr - Tags: architecture, fintech, monolith, microservices, adr, greenfield, modular, trade-offs ### Playbook: Multi-agent, when 1 is enough and when you need to orchestrate Every additional agent doubles cost, latency, and error surface. This playbook provides surgical criteria for choosing between single agent, supervisor, pipeline, and debate topologies, with decision tables, visual diagrams, and the traps that destroy multi-agent systems in production. - HTML: https://fernando.moretes.com/studies/playbook-multi-agente-quando-1-basta-e-quando-orquestrar - Markdown PT: https://fernando.moretes.com/studies/playbook-multi-agente-quando-1-basta-e-quando-orquestrar/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-multi-agente-quando-1-basta-e-quando-orquestrar/study.md?lang=en - Type: playbook - Tags: multi-agent, bedrock, genai, orchestration, llm, aws, agents, architecture ### Playbook: A Production AI Agent on AWS in 7 Steps Ninety percent of AI agents die in the notebook. This playbook covers the 7 steps that separate a working prototype from a reliable production agent on AWS, from trigger to guardrail, covering loop topology, least-privilege tools, external verifier, and execution budget. Opinionated, concrete, and grounded in the real primitives of Amazon Bedrock AgentCore. - HTML: https://fernando.moretes.com/studies/playbook-agente-de-producao-na-aws-7-passos - Markdown PT: https://fernando.moretes.com/studies/playbook-agente-de-producao-na-aws-7-passos/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-agente-de-producao-na-aws-7-passos/study.md?lang=en - Type: playbook - Tags: agents, bedrock, agentcore, genai, aws, production, observability, guardrails ### Playbook: From Prompt to Pipeline, the 5 Stages of a Reliable Agent An agent is not born reliable, it is built stage by stage, from a simple prompt to an operable system with observability, guardrails, and audit trails. This playbook maps each stage, what you gain, what you risk, and when to stop climbing. The bottleneck is not the prompt; it is the system around it. - HTML: https://fernando.moretes.com/studies/playbook-do-prompt-ao-pipeline-maturidade-de-agente - Markdown PT: https://fernando.moretes.com/studies/playbook-do-prompt-ao-pipeline-maturidade-de-agente/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-do-prompt-ao-pipeline-maturidade-de-agente/study.md?lang=en - Type: playbook - Tags: agents, llm, genai, aws-bedrock, react, pipeline, observability, guardrails ### Playbook: RAG in Production: The 15-Item Checklist Before You Go Live Dumping documents into a vector store is not production RAG, it's a prototype waiting to fail publicly. This playbook covers the 15 concrete, testable items that separate a reliable RAG pipeline from one that hallucinates, leaks PII, and blows budget without anyone noticing. The uncomfortable truth: ~80% of hallucinations are retrieval failures, not model failures. - HTML: https://fernando.moretes.com/studies/playbook-rag-em-producao-checklist - Markdown PT: https://fernando.moretes.com/studies/playbook-rag-em-producao-checklist/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-rag-em-producao-checklist/study.md?lang=en - Type: playbook - Tags: RAG, GenAI, AWS Bedrock, vector search, production, evaluation, guardrails, OpenSearch ### Playbook: Where to Run AI on AWS: Lambda vs Fargate vs ECS/EKS (GPU) Choosing the wrong compute for AI workloads on AWS is the most expensive mistake teams make when scaling from prototype to production. This playbook maps Lambda, Fargate, ECS/EKS+GPU, and Bedrock against the axes that actually matter, duration, GPU, traffic pattern, and cost per token, and delivers an actionable decision tree for every scenario. - HTML: https://fernando.moretes.com/studies/playbook-onde-rodar-ia-na-aws-lambda-fargate-eks-gpu - Markdown PT: https://fernando.moretes.com/studies/playbook-onde-rodar-ia-na-aws-lambda-fargate-eks-gpu/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-onde-rodar-ia-na-aws-lambda-fargate-eks-gpu/study.md?lang=en - Type: playbook - Tags: aws, lambda, fargate, eks, gpu, inference, bedrock, ai-compute ### Playbook: Vector Store on AWS: OpenSearch Serverless vs Aurora pgvector vs S3 Vectors Picking the wrong vector store is where your RAG bill explodes, or where latency delivers unacceptable p99 in production. This playbook maps the three main AWS paths (OpenSearch Serverless, Aurora pgvector, S3 Vectors) across three real axes: required latency, cost model, and operational burden. Leave with a defensible decision, not the tutorial default. - HTML: https://fernando.moretes.com/studies/playbook-vector-store-na-aws-opensearch-pgvector-s3-vectors - Markdown PT: https://fernando.moretes.com/studies/playbook-vector-store-na-aws-opensearch-pgvector-s3-vectors/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-vector-store-na-aws-opensearch-pgvector-s3-vectors/study.md?lang=en - Type: playbook - Tags: vector-store, RAG, OpenSearch, pgvector, S3-Vectors, AWS, GenAI, architecture ### Playbook: MCP in Practice: Connect an Agent to an Internal Tool The Model Context Protocol eliminates the hand-rolled adapter between agent and tool: an MCP server exposes tools with name, description, and schema; the client discovers and calls them without direct coupling. This playbook covers the three concrete steps to stand up an MCP server, describe a tool properly, and connect the agent, with special attention to security, which is where most implementations fail. - HTML: https://fernando.moretes.com/studies/playbook-mcp-na-pratica-conecte-um-agente-a-uma-ferramenta - Markdown PT: https://fernando.moretes.com/studies/playbook-mcp-na-pratica-conecte-um-agente-a-uma-ferramenta/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-mcp-na-pratica-conecte-um-agente-a-uma-ferramenta/study.md?lang=en - Type: playbook - Tags: MCP, AI Agents, GenAI, AWS Bedrock, Tool Use, Security, Event-Driven, Architecture ### Playbook: AI, ML, Deep Learning, LLM and Agents, the Map for Choosing the Right Tool A practical layered guide for engineers and architects who need to stop defaulting to 'let's use an LLM'. The correct map is AI → ML → Deep Learning → GenAI/LLM → Agents, each layer a subset of the previous, not synonyms. The right question is never 'which model?', it's 'what is the simplest tool that solves this well?'. - HTML: https://fernando.moretes.com/studies/playbook-ia-ml-deep-learning-llm-agentes-o-mapa - Markdown PT: https://fernando.moretes.com/studies/playbook-ia-ml-deep-learning-llm-agentes-o-mapa/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-ia-ml-deep-learning-llm-agentes-o-mapa/study.md?lang=en - Type: playbook - Tags: ai, machine-learning, llm, agents, deep-learning, genai, aws, fundamentals ### Playbook: Zero-Trust on AWS from Scratch: 6 Steps That Fit in a Sprint Zero-trust is not a product or a six-month project, it is a set of architectural decisions you can start implementing today. This playbook presents six concrete, prioritized steps to eliminate implicit trust on AWS, reduce blast radius, and build continuous auditing, without halting delivery. - HTML: https://fernando.moretes.com/studies/playbook-zero-trust-na-aws-em-6-passos - Markdown PT: https://fernando.moretes.com/studies/playbook-zero-trust-na-aws-em-6-passos/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/playbook-zero-trust-na-aws-em-6-passos/study.md?lang=en - Type: playbook - Tags: zero-trust, aws-security, iam, privatelink, cloudtrail, identity, least-privilege, microsegmentation ### OpenAI (2024): How a New Telemetry Service Took Down the Kubernetes Control Plane In December 2024, OpenAI deployed a new telemetry agent across its entire Kubernetes fleet simultaneously. The resulting overload on the API servers cascaded into a global outage of ChatGPT, the API, and Sora for several hours, and the saturated control plane itself blocked the rollback. An analysis of how control plane vs. data plane separation, gradual rollouts, and observability decoupling were not optional. - HTML: https://fernando.moretes.com/studies/openai-2024-kubernetes-control-plane - Markdown PT: https://fernando.moretes.com/studies/openai-2024-kubernetes-control-plane/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/openai-2024-kubernetes-control-plane/study.md?lang=en - Type: postmortem - Tags: kubernetes, postmortem, control-plane, telemetry, openai, resiliência, dns, rollout ### CrowdStrike (2024): the content update that took down 8.5 million Windows machines On July 19, 2024, a CrowdStrike Falcon sensor content update caused an out-of-bounds memory read in a Windows kernel driver, triggering BSODs at global scale and halting critical infrastructure across aviation, healthcare, and finance. The absence of progressive rollout for content updates and a bug in the internal validator were the central vectors of the incident. This post-mortem examines the failure chain, the real blast radius, and the architectural lessons every engineer operating software in kernel-space must internalize. - HTML: https://fernando.moretes.com/studies/crowdstrike-falcon-2024 - Markdown PT: https://fernando.moretes.com/studies/crowdstrike-falcon-2024/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/crowdstrike-falcon-2024/study.md?lang=en - Type: postmortem - Tags: crowdstrike, kernel, bsod, deploy, resiliência, windows, postmortem, blast-radius ### Kafka at Scale: Tiered Storage, KRaft, and Exactly-Once An in-depth analysis of Apache Kafka's internal architecture, the log/segment model, ZooKeeper elimination via KRaft, data offload to S3 with Tiered Storage, exactly-once semantics, and what Amazon MSK abstracts (and what it does not). A technical teardown for those who need to operate Kafka for real. - HTML: https://fernando.moretes.com/studies/kafka-tiered-storage-kraft-exactly-once - Markdown PT: https://fernando.moretes.com/studies/kafka-tiered-storage-kraft-exactly-once/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/kafka-tiered-storage-kraft-exactly-once/study.md?lang=en - Type: teardown - Tags: kafka, streaming, event-driven, amazon-msk, tiered-storage, kraft, exactly-once, data-platform ### Google Cloud × UniSuper (2024): When a Misconfiguration Deleted an Entire Subscription In May 2024, a misconfiguration during the provisioning of a private VMware environment on Google Cloud resulted in the complete deletion of UniSuper's subscription across two regions. Recovery was only possible because UniSuper maintained backups with a separate cloud provider, a decision that saved data for 500,000 members. The incident exposes systemic failures in deletion safeguards, automation blast radius, and the fallacy of assuming resilience within a single provider. - HTML: https://fernando.moretes.com/studies/google-cloud-unisuper-2024 - Markdown PT: https://fernando.moretes.com/studies/google-cloud-unisuper-2024/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/google-cloud-unisuper-2024/study.md?lang=en - Type: postmortem - Tags: postmortem, google-cloud, resiliência, backup, gcve, exclusão-acidental, multi-cloud, disaster-recovery ### Figma: Horizontal Postgres Sharding Without Stopping Growth In 2022, Figma hit the physical limits of its monolithic Postgres database and executed a horizontal sharding migration using key-based partitioning, dynamic routing, and incremental data movement, all without downtime and without halting product growth. This teardown reconstructs the architecture, analyzes the technical decisions, and points out what I would do differently. - HTML: https://fernando.moretes.com/studies/figma-postgres-sharding - Markdown PT: https://fernando.moretes.com/studies/figma-postgres-sharding/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/figma-postgres-sharding/study.md?lang=en - Type: teardown - Tags: postgres, sharding, data-platform, database, scalability, partitioning, migration, figma ### Datadog (2023): how a systemd security patch took down 5 regions simultaneously In March 2023, an automatic security update to systemd-networkd restarted the networking subsystem on tens of thousands of Datadog Kubernetes nodes simultaneously, severing Cilium-managed connectivity across multiple regions. The incident exposed the risks of uncontrolled OS auto-updates, the critical dependency on CNI plugins in the data plane, and the lack of regional isolation in update pipelines. - HTML: https://fernando.moretes.com/studies/datadog-2023-multiregion-outage - Markdown PT: https://fernando.moretes.com/studies/datadog-2023-multiregion-outage/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/datadog-2023-multiregion-outage/study.md?lang=en - Type: postmortem - Tags: postmortem, datadog, systemd, cilium, kubernetes, observability, blast-radius, auto-update ### Discord: How to Store Trillions of Messages: Cassandra → ScyllaDB Migration Teardown Discord migrated its message storage from Apache Cassandra to ScyllaDB, eliminating unpredictable tail latencies and GC pauses that affected millions of users. This teardown reconstructs the architecture, examines the engineering decisions and trade-offs involved, and presents my critical read of what was done well, and what I would do differently. - HTML: https://fernando.moretes.com/studies/discord-trillions-of-messages - Markdown PT: https://fernando.moretes.com/studies/discord-trillions-of-messages/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/discord-trillions-of-messages/study.md?lang=en - Type: teardown - Tags: discord, scylladb, cassandra, rust, data-platform, migration, wide-column, messaging ### Atlassian 2022: when a maintenance script deletes 400 customers for two weeks In April 2022, a poorly parameterized maintenance script executed hard deletes on ~400 Atlassian Cloud customer sites, including Jira, Confluence, and other products. The absence of soft-delete, lack of mandatory dry-run, and nonexistent mass-restore tooling turned a minutes-long operational mistake into up to 14 days of downtime. This post-mortem examines the failure chain, the real blast radius, and the structural lessons every platform team should internalize. - HTML: https://fernando.moretes.com/studies/atlassian-2022-deletion-outage - Markdown PT: https://fernando.moretes.com/studies/atlassian-2022-deletion-outage/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/atlassian-2022-deletion-outage/study.md?lang=en - Type: postmortem - Tags: postmortem, atlassian, data-loss, incident-response, soft-delete, operational-safety, cloud-platform, deploy ### Roblox 2021: 73 Hours of Downtime, Consul and the Load Effect In October 2021, Roblox suffered 73 consecutive hours of unavailability, the largest outage in the platform's history. The root cause was a combination of BoltDB contention (Consul's backend) amplified by a newly enabled telemetry streaming feature during a period of elevated traffic. This post-mortem reconstructs the failure chain, analyzes the infrastructure decisions involved, and extracts lessons applicable to any platform relying on service mesh and distributed coordination. - HTML: https://fernando.moretes.com/studies/roblox-2021-consul - Markdown PT: https://fernando.moretes.com/studies/roblox-2021-consul/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/roblox-2021-consul/study.md?lang=en - Type: postmortem - Tags: postmortem, consul, service-mesh, resiliência, boltdb, distributed-systems, roblox, incident-analysis ### Notion: The Block Model and Postgres Sharding Notion grew from a monolithic Postgres database to a horizontally sharded architecture, partitioning data by tenant to sustain explosive pandemic-era growth. This teardown reconstructs the data modeling decisions, migration process, and real trade-offs of operating Postgres at scale. - HTML: https://fernando.moretes.com/studies/notion-sharding-postgres - Markdown PT: https://fernando.moretes.com/studies/notion-sharding-postgres/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/notion-sharding-postgres/study.md?lang=en - Type: teardown - Tags: postgres, sharding, data-modeling, scalability, migration, multi-tenant, block-model, databases ### Meta 2021: How a Maintenance Command Took Facebook Down for 6 Hours On October 4, 2021, a misconfigured maintenance command withdrew all BGP routes from Meta's backbone, making authoritative DNS servers unreachable from the internet. The cascade effect took down Facebook, Instagram, WhatsApp, and Oculus simultaneously for approximately six hours, affecting billions of users and exposing critical weaknesses in access control systems and emergency recovery procedures. - HTML: https://fernando.moretes.com/studies/meta-bgp-2021 - Markdown PT: https://fernando.moretes.com/studies/meta-bgp-2021/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/meta-bgp-2021/study.md?lang=en - Type: postmortem - Tags: bgp, dns, postmortem, networking, meta, facebook, outage, infrastructure ### Netflix: Chaos Engineering and Resilience by Design An architectural reconstruction of how Netflix turned inevitable failures into deliberate practice, from the Simian Army to automated regional failover. This teardown examines the technical decisions, real trade-offs, and what separates genuine resilience from cosmetic high availability. - HTML: https://fernando.moretes.com/studies/netflix-chaos-engineering - Markdown PT: https://fernando.moretes.com/studies/netflix-chaos-engineering/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/netflix-chaos-engineering/study.md?lang=en - Type: teardown - Tags: chaos-engineering, resiliência, netflix, aws, microservices, failover, simian-army, distributed-systems ### AWS Kinesis us-east-1 (2020): When an OS Thread Limit Took Down Half of AWS In November 2020, a capacity expansion on Amazon Kinesis front-end servers exhausted the operating system's per-process thread limit, triggering cascading failures that impacted Cognito, CloudWatch, Lambda, ECS, and dozens of other services in us-east-1 for over eight hours. The incident exposed hidden inter-service dependencies within AWS and the risks of seemingly safe operational changes in large-scale systems. - HTML: https://fernando.moretes.com/studies/aws-kinesis-us-east-1-2020 - Markdown PT: https://fernando.moretes.com/studies/aws-kinesis-us-east-1-2020/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/aws-kinesis-us-east-1-2020/study.md?lang=en - Type: postmortem - Tags: postmortem, aws, kinesis, resiliência, cascata, threads, us-east-1, dependências ### Uber DOMA: How Domain Layers Tamed the Microservice Explosion With over 2,200 microservices and uncontrollable cross-cutting dependencies, Uber faced a classic organizational scale problem disguised as a technical one. The answer was DOMA: Domain-Oriented Microservice Architecture, an approach that groups services into domains, exposes well-defined interfaces, and introduces abstraction layers to recover lost cohesion. This teardown reconstructs the architecture, analyzes the decisions, and points out what I'd do differently. - HTML: https://fernando.moretes.com/studies/uber-domain-oriented-microservices - Markdown PT: https://fernando.moretes.com/studies/uber-domain-oriented-microservices/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/uber-domain-oriented-microservices/study.md?lang=en - Type: teardown - Tags: microservices, domain-driven-design, uber, platform-engineering, architecture, scalability, organizational-design, api-gateway ### Cloudflare 2019: The Regex That Took Down a Global Network On July 2, 2019, a single WAF rule containing a regex with catastrophic backtracking saturated 100% of CPU across all Cloudflare servers globally, taking down services for approximately 27 minutes. The incident exposed critical failures in the rule deployment process, the absence of protection against algorithmic complexity, and the insufficiency of the testing pipeline to detect pathological patterns. - HTML: https://fernando.moretes.com/studies/cloudflare-regex-2019 - Markdown PT: https://fernando.moretes.com/studies/cloudflare-regex-2019/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/cloudflare-regex-2019/study.md?lang=en - Type: postmortem - Tags: postmortem, cloudflare, waf, regex, catastrophic-backtracking, edge, cpu-saturation, incident ### GitHub 2018: 43 Seconds of Partition, 24 Hours of MySQL Split-Brain On October 21, 2018, a 43-second network maintenance window triggered a failure cascade that kept GitHub degraded for nearly 24 hours. Orchestrator promoted replicas in the wrong regions, creating a split-brain between datacenters, revealing how failover automation without proper fencing can turn a micro-failure into a data consistency catastrophe. - HTML: https://fernando.moretes.com/studies/github-2018-network-partition - Markdown PT: https://fernando.moretes.com/studies/github-2018-network-partition/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/github-2018-network-partition/study.md?lang=en - Type: postmortem - Tags: postmortem, mysql, split-brain, orchestrator, resiliência, dados, failover, github ### Shopify: Pods Architecture to Scale Through Black Friday Shopify redesigned its monolithic infrastructure around isolated pods and database sharding to survive extreme BFCM traffic spikes without global degradation. This teardown reconstructs the architecture, examines the trade-off decisions, and evaluates what I would do differently based on 16 years operating mission-critical systems. - HTML: https://fernando.moretes.com/studies/shopify-pods-architecture - Markdown PT: https://fernando.moretes.com/studies/shopify-pods-architecture/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/shopify-pods-architecture/study.md?lang=en - Type: teardown - Tags: scalability, sharding, pods, shopify, bfcm, multi-tenant, rails, database ### AWS S3 us-east-1 (2017): when a typo brings down the internet On February 28, 2017, an AWS engineer executed a debug command with an incorrect parameter and removed far more servers from S3's indexing subsystem than intended. The result was four hours of severe degradation in us-east-1 that affected hundreds of dependent services, from monitoring tools to major SaaS platforms. The incident exposed structural weaknesses around implicit dependencies, the absence of rate limiting on destructive operations, and the fallacy of assuming a single AWS region would be sufficiently resilient. - HTML: https://fernando.moretes.com/studies/aws-s3-us-east-1-2017 - Markdown PT: https://fernando.moretes.com/studies/aws-s3-us-east-1-2017/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/aws-s3-us-east-1-2017/study.md?lang=en - Type: postmortem - Tags: s3, aws, resiliência, postmortem, us-east-1, blast-radius, operações, dependência-implícita ### Stripe: API Design and Idempotency Keys An in-depth technical analysis of how Stripe solved the problem of safe retries in payment APIs using idempotency keys, request state storage, and rate limiting, design decisions that became an industry reference. - HTML: https://fernando.moretes.com/studies/stripe-api-idempotency - Markdown PT: https://fernando.moretes.com/studies/stripe-api-idempotency/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/stripe-api-idempotency/study.md?lang=en - Type: teardown - Tags: api-design, idempotency, payments, stripe, distributed-systems, rate-limiting, reliability, fintech ### Knight Capital (2012): US$440M in 45 Minutes from a Partial Deployment On August 1, 2012, Knight Capital lost US$440 million in under an hour due to a partial deployment that left legacy code active on one of eight trading servers. A reused configuration flag activated an obsolete function that fired millions of unintended orders into the US market. The incident is a canonical case of how deployment process failures and the absence of kill-switch mechanisms can destroy a company in minutes. - HTML: https://fernando.moretes.com/studies/knight-capital-2012 - Markdown PT: https://fernando.moretes.com/studies/knight-capital-2012/study.md?lang=pt - Markdown EN: https://fernando.moretes.com/studies/knight-capital-2012/study.md?lang=en - Type: postmortem - Tags: postmortem, deploy, trading, risk-management, financial-systems, configuration, incident, distributed-systems ## Open Source Repository Guides ### M5Cardputer-SSHClient Pocket SSH client on the M5Cardputer: ESP32, physical keyboard and a remote shell - HTML: https://fernando.moretes.com/open-source/M5Cardputer-SSHClient - Markdown EN: https://fernando.moretes.com/open-source/M5Cardputer-SSHClient/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/M5Cardputer-SSHClient/guide.md?lang=pt - GitHub: https://github.com/fernandofatech/tool-m5cardputer-sshclient - Homepage: https://fernando.moretes.com - Topics: arduino, cardputer, cpp, embedded, esp32, iot, m5stack, moretes, portfolio, ssh ### RS-Visao-Real Python reference skeleton for GIS and satellite imagery in RS emergency response - HTML: https://fernando.moretes.com/open-source/RS-Visao-Real - Markdown EN: https://fernando.moretes.com/open-source/RS-Visao-Real/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/RS-Visao-Real/guide.md?lang=pt - GitHub: https://github.com/fernandofatech/ref-rs-visao-real - Homepage: https://fernando.moretes.com - Topics: brazil, emergency-response, gis, moretes, open-source, portfolio, python, rio-grande-do-sul, satellite-imagery ### setup-macos-developer Shell-based macOS developer setup: the same environment on every new machine - HTML: https://fernando.moretes.com/open-source/setup-macos-developer - Markdown EN: https://fernando.moretes.com/open-source/setup-macos-developer/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/setup-macos-developer/guide.md?lang=pt - GitHub: https://github.com/fernandofatech/dot-setup-macos-developer - Homepage: https://fernando.moretes.com - Topics: automation, bash, developer-setup, developer-tools, dotfiles, homebrew, macos, moretes, portfolio, productivity ### fernandofatech GitHub profile README: the front door to 154 repos in one organization - HTML: https://fernando.moretes.com/open-source/fernandofatech - Markdown EN: https://fernando.moretes.com/open-source/fernandofatech/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/fernandofatech/guide.md?lang=pt - GitHub: https://github.com/fernandofatech/fernandofatech - Homepage: https://fernando.moretes.com - Topics: github-profile, moretes, portfolio, profile, readme, solution-architect, solution-architecture ### diagram-as-code AWS diagrams from Git-versioned YAML, with draw.io export and a web editor - HTML: https://fernando.moretes.com/open-source/diagram-as-code - Markdown EN: https://fernando.moretes.com/open-source/diagram-as-code/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/diagram-as-code/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/tool-diagram-as-code - Homepage: https://dac.moretes.com - Topics: architecture, diagram-as-code, moretes, portfolio ### architect-frameworks-hub A fast reference for Well-Architected, TOGAF, C4, ArchiMate, DDD, 12-Factor and Cynefin - HTML: https://fernando.moretes.com/open-source/architect-frameworks-hub - Markdown EN: https://fernando.moretes.com/open-source/architect-frameworks-hub/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/architect-frameworks-hub/guide.md?lang=pt - GitHub: https://github.com/fernandofatech/ref-architect-frameworks-hub - Topics: ### solution-architecture-mcp-toolkit ADRs, Well-Architected and threat models as tools an AI agent can call - HTML: https://fernando.moretes.com/open-source/solution-architecture-mcp-toolkit - Markdown EN: https://fernando.moretes.com/open-source/solution-architecture-mcp-toolkit/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/solution-architecture-mcp-toolkit/guide.md?lang=pt - GitHub: https://github.com/fernandofatech/app-solution-architecture-mcp-toolkit - Homepage: https://mcp-toolkit.moretes.com - Topics: adr, ai, ai-tools, architecture-decision-records, aws, devsecops, mcp, moretes, portfolio, python, solution-architecture, vercel, well-architected ### homebrew-google-terminal-search Homebrew tap for google-terminal-search: one `brew install` instead of copying a script by hand - HTML: https://fernando.moretes.com/open-source/homebrew-google-terminal-search - Markdown EN: https://fernando.moretes.com/open-source/homebrew-google-terminal-search/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/homebrew-google-terminal-search/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/dot-homebrew-google-terminal-search - Homepage: https://fernando.moretes.com - Topics: cli, developer-tools, homebrew, homebrew-tap, moretes, package-manager, portfolio, ruby ### queue-advisor-pricing-app Compare cost and fit of SQS, Kinesis, EventBridge and MSK before you pick a queue - HTML: https://fernando.moretes.com/open-source/queue-advisor-pricing-app - Markdown EN: https://fernando.moretes.com/open-source/queue-advisor-pricing-app/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/queue-advisor-pricing-app/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/app-queue-advisor-pricing - Homepage: https://queue.moretes.com - Topics: aws, eventbridge, finops, kinesis, messaging, moretes, portfolio, pricing, pricing-calculator, sqs, typescript, vercel ### aws-event-driven-finops-platform A banking event mesh on AWS where cost is an architectural requirement - HTML: https://fernando.moretes.com/open-source/aws-event-driven-finops-platform - Markdown EN: https://fernando.moretes.com/open-source/aws-event-driven-finops-platform/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/aws-event-driven-finops-platform/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/app-aws-event-driven-finops-platform - Homepage: https://finops.moretes.com - Topics: ai, aws, banking, devsecops, event-driven-architecture, eventbridge, finops, kinesis, moretes, msk, portfolio, solution-architecture, sqs, vercel ### aws-agentic-ai-reference-architecture AWS agentic AI reference architecture built for production constraints, not demos - HTML: https://fernando.moretes.com/open-source/aws-agentic-ai-reference-architecture - Markdown EN: https://fernando.moretes.com/open-source/aws-agentic-ai-reference-architecture/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/aws-agentic-ai-reference-architecture/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/app-aws-agentic-ai-reference-architecture - Homepage: https://agentic-ai.moretes.com - Topics: agentic-ai, ai, aws, bedrock, devsecops, guardrails, mcp, moretes, observability, portfolio, solution-architecture, vercel, well-architected ### aws-pattern-library 22 AWS reference architectures with diagram, ADR, pillars and cost, ready to copy - HTML: https://fernando.moretes.com/open-source/aws-pattern-library - Markdown EN: https://fernando.moretes.com/open-source/aws-pattern-library/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/aws-pattern-library/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/ref-aws-pattern-library - Topics: ### Deskbuddy ESP32 touchscreen smart desk dashboard, firmware, web UI, and browser installer in one repo. - HTML: https://fernando.moretes.com/open-source/Deskbuddy - Markdown EN: https://fernando.moretes.com/open-source/Deskbuddy/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/Deskbuddy/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/tool-deskbuddy - Homepage: https://fernando.moretes.com - Topics: fork, moretes, portfolio ### google-terminal-search Google search from your terminal: a 17-line Bash script, zero dependencies - HTML: https://fernando.moretes.com/open-source/google-terminal-search - Markdown EN: https://fernando.moretes.com/open-source/google-terminal-search/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/google-terminal-search/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/tool-google-terminal-search - Homepage: https://fernando.moretes.com - Topics: automation, bash, cli, developer-tools, google-search, moretes, portfolio, productivity, terminal ### bedrock-agent-starter Bedrock agent starter with tools, memory, Terraform and evals already wired - HTML: https://fernando.moretes.com/open-source/bedrock-agent-starter - Markdown EN: https://fernando.moretes.com/open-source/bedrock-agent-starter/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/bedrock-agent-starter/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/app-bedrock-agent-starter - Homepage: https://fernando-moretes.github.io/app-bedrock-agent-starter/ - Topics: ai, ai-agents, aws, bedrock, github-actions, lambda, moretes, portfolio, solution-architecture, terraform ### mcp-aws-solution-architect Bilingual MCP server with 5 deterministic tools for AWS solution architecture - HTML: https://fernando.moretes.com/open-source/mcp-aws-solution-architect - Markdown EN: https://fernando.moretes.com/open-source/mcp-aws-solution-architect/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/mcp-aws-solution-architect/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/app-mcp-aws-solution-architect - Homepage: https://fernando-moretes.github.io/app-mcp-aws-solution-architect/ - Topics: ai, ai-tools, architecture, aws, claude, github-actions, llm-tools, mcp, model-context-protocol, moretes, portfolio, python, solution-architecture, well-architected ### sa-daily-toolkit ADRs, Well-Architected, threat modeling, sizing and RFCs in one place, not lost in chats - HTML: https://fernando.moretes.com/open-source/sa-daily-toolkit - Markdown EN: https://fernando.moretes.com/open-source/sa-daily-toolkit/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/sa-daily-toolkit/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/ref-sa-daily-toolkit - Topics: ### adr-decision-platform ADRs and RFCs in MADR, Nygard and Y-statement, with a browsable index and GitHub sync - HTML: https://fernando.moretes.com/open-source/adr-decision-platform - Markdown EN: https://fernando.moretes.com/open-source/adr-decision-platform/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/adr-decision-platform/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/ref-adr-decision-platform - Topics: ### aws-ai-reference-architectures Six AWS AI reference architectures with decisions, S/M/L cost and Terraform - HTML: https://fernando.moretes.com/open-source/aws-ai-reference-architectures - Markdown EN: https://fernando.moretes.com/open-source/aws-ai-reference-architectures/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/aws-ai-reference-architectures/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/app-aws-ai-reference-architectures - Homepage: https://fernando-moretes.github.io/app-aws-ai-reference-architectures/ - Topics: ai, architecture, aws, bedrock, github-actions, mlops, moretes, portfolio, reference-architecture, sagemaker, solution-architecture, terraform, well-architected ### finops-architect-toolkit AWS FinOps calculators: RI vs On-Demand, S3 classes, Lambda costs and tagging - HTML: https://fernando.moretes.com/open-source/finops-architect-toolkit - Markdown EN: https://fernando.moretes.com/open-source/finops-architect-toolkit/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/finops-architect-toolkit/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/ref-finops-architect-toolkit - Topics: ### dailyfocus One focus per day, tasks, timer and reflection: productivity without a control panel - HTML: https://fernando.moretes.com/open-source/dailyfocus - Markdown EN: https://fernando.moretes.com/open-source/dailyfocus/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/dailyfocus/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/app-dailyfocus - Homepage: https://dailyfocus.moretes.com - Topics: focus, moretes, nextjs, pomodoro, portfolio, productivity, tasks, typescript, vercel ### aws-architecture-studio ADRs, Mermaid diagrams and AWS patterns in one open-source studio, no backend - HTML: https://fernando.moretes.com/open-source/aws-architecture-studio - Markdown EN: https://fernando.moretes.com/open-source/aws-architecture-studio/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/aws-architecture-studio/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/ref-aws-architecture-studio - Topics: ### architecture-diagrams-library Architecture diagrams as code: AWS, C4, BPMN and events, reviewable in a PR - HTML: https://fernando.moretes.com/open-source/architecture-diagrams-library - Markdown EN: https://fernando.moretes.com/open-source/architecture-diagrams-library/guide.md?lang=en - Markdown PT: https://fernando.moretes.com/open-source/architecture-diagrams-library/guide.md?lang=pt - GitHub: https://github.com/fernando-moretes/ref-architecture-diagrams-library - Topics: ## E-books ### Inside the Bank: The Architecture Elevator Complete e-book by Fernando F. Azevedo on Gregor Hohpe's Architecture Elevator applied to banks: from business to the ledger, from events to AI with guardrails, from security to FinOps. For architects and developers in financial services. - HTML: https://fernando.moretes.com/ebooks/elevador-de-arquitetura-bancos - Markdown PT: https://fernando.moretes.com/ebooks/elevador-de-arquitetura-bancos/ebook.md - Markdown EN: https://fernando.moretes.com/ebooks/elevador-de-arquitetura-bancos/ebook.md?lang=en - PDF: https://fernando.moretes.com/ebooks/elevador-de-arquitetura-bancos/ebook.pdf - Kindle/EPUB: https://fernando.moretes.com/ebooks/elevador-de-arquitetura-bancos/ebook.epub - Tags: Elevador de Arquitetura, Architecture Elevator, Bancos, Sistemas Financeiros, AWS, Arquitetura de Soluções, Event-Driven Architecture, Core Banking, Ledger, Amazon Bedrock, EKS, FinOps, BACEN, Pix