Newsletter
Deep AWS + AI engineering
in your inbox
This is the newsletter for engineers who want the technical detail, not the hype. Each issue covers a real problem from a production AWS or AI deployment: the CDK pattern that survived a real workload, the Bedrock AgentCore gotcha that cost an afternoon, the cost decision that shows up on the bill.
- ✓ A new write-up every Tuesday, only when it's worth your time
- ✓ Technical and specific: Bedrock, CDK, AgentCore, IAM, real code
- ✓ Written by me, not generated: the same voice as the blog
- ✓ No sponsors, no affiliate links, no weekly digests
No spam. Every email has a one-click unsubscribe link.
Recent posts: a sample of what lands in the newsletter
Your LLM security diagram defends the wrong layer
The LLM security diagram you have seen a dozen times is a threat map. Read as a defence it makes you patch every box at the layer the attacker controls. The fix is one deterministic boundary the diagram leaves out, in code the model never touches.
The LLM is not a security boundary
Designing a production agent over sensitive data: no control makes the flow hole-free. You rank the layers, assume each one leaks, and stack them so no single hole reaches the data. Here is the code that does it.
Field Notes: The AgentCore Memory write that returns success and reads back empty
AgentCore long-term memory has a read-after-write gotcha the docs skip: a direct BatchCreateMemoryRecords write returns 201 and stays unsearchable for 15 to 30 seconds. Measured, with the two-tier model that explains it.
Every dashboard was green while the agent burned six figures a year
The most expensive AI agent failures don't throw an error, they hide. One ran at a six-figure-a-year rate for days while every dashboard stayed green, because the signals that catch it, per-session cost and anomalies, are the ones nobody watches. Why agent loops run away, and the two cost instruments your monitoring is missing.
Field Notes: Turning prompt caching on for a production Bedrock workload
Strands' BedrockModel ships with prompt caching off. Two kwargs turn it on, one per-model gotcha catches you, and a 10-turn driver measures 99.9% / 99.8% hit ratios on Nova Pro and Sonnet 4.6 against an 8,156-token production system prefix. The per-call usage block proves it in seconds, not waiting on CloudWatch.