Writing

Field notes from building and running cloud infrastructure — architecture reviews, reliability practices, and the cost lessons learned along the way.

Featured

Site-to-Site VPN — On-Premises ⇄ AWS with BGP HA, Hybrid DNS, and Credential-Vended Aurora Access

ArchitectureHybrid Network

Jul 6, 2026·75 min read

Site-to-Site VPN — On-Premises ⇄ AWS with BGP HA, Hybrid DNS, and Credential-Vended Aurora Access

A real on-prem server joined to a fully-private AWS VPC: dual-tunnel BGP failover, hybrid DNS in both directions, and Aurora access with no standing credentials — plus the lessons quickstarts skip.

Site-to-Site VPN — On-Premises ⇄ AWS with BGP HA, Hybrid DNS, and Credential-Vended Aurora Access

A real on-prem server joined to a fully-private AWS VPC: dual-tunnel BGP failover, hybrid DNS in both directions, and Aurora access with no standing credentials — plus the lessons quickstarts skip.

Jun 26, 2026·13 min read

CloudFront Viewer mTLS — Verifying the Client at the Edge

An API key leaks like any bearer token; an IP allowlist proves the network, not the caller. Viewer mTLS validates a client certificate at the edge — rejecting untrusted clients before any compute runs.

Apr 23, 2026·14 min read

CloudFront mTLS to Origins — Retiring the Shared-Secret Header

Anyone who finds your ALB's DNS name can bypass CloudFront — and the X-Origin-Verify header is a bearer token waiting to leak. Origin mTLS moves origin trust from shared secrets to X.509 identity.

ArchitectureBackup & DR

Apr 23, 2026·20 min read

Automating Backup Validation with AWS Backup Restore Testing

A backup job completing is not proof of recoverability. Here's how to build a continuous, automated restore testing pipeline on AWS that provides auditable DR evidence without manual drills.

Have a topic in mind?

Always up for a good technical conversation.

Suggest a topic, share a war story, or ask the question — happy to dig into the details.

Suggest a topic Connect on LinkedIn