Essays and field notes
Long-form essays, practical notes, and production-shaped learning from the Cloud Sandbox.
Browse Writing
63 entries in the Cloud Sandbox.
Year
26 entries
Field note
A central AWS network account should own shared address planning, transit routing, central egress, inspection, hybrid connectivity and selected DNS infrastructure. Workload VPCs, application ingress and service-level network controls should normally remain with the accounts that operate those workloads.
Field note
AWS Control Tower can establish and govern a multi-account landing zone using AWS Organizations, IAM Identity Center, CloudTrail, Config, Service Catalog and managed controls. bfstore chose a manually engineered landing zone to preserve explicit ownership, learning depth and a custom policy-testing workflow.
Field note
AWS telemetry does not emerge through one universal export path. Application signals can travel through OpenTelemetry, while CloudWatch metrics, managed-service logs, flow logs, CloudTrail and configuration evidence require different streaming, polling and durable-ingestion patterns.
Field note
Route 53 failover routing can redirect new DNS resolutions from a primary endpoint to a secondary endpoint. It is valuable when the secondary is independently usable, the health signal represents the service capability, and caching, data recovery, failback and network reachability have all been designed.
Field note
Route 53 Resolver endpoints extend AWS DNS across hybrid, multi-cloud and external resolver boundaries. Inbound endpoints let other networks query AWS private DNS, while outbound endpoints let AWS forward selected namespaces to external DNS authorities.
Field note
Route 53 private hosted zones give selected resolver views a private DNS namespace. Their architecture depends on zone ownership, direct VPC associations or Route 53 Profiles, resolver-rule precedence, split-view behaviour, record design, caching, health, routing and operational evidence.
Field note
A practical STRIDE threat model for bfstore’s checkout and delivery paths. The exercise begins with scope, assets, actors, data flows and explicit trust boundaries before turning threats into prioritised, testable security work.
Field note
Kubernetes resource requests, limits, LimitRanges and ResourceQuotas solve different capacity problems. For Go services, those controls must also account for garbage collection, GOMEMLIMIT, container-aware GOMAXPROCS, sidecars, autoscaling and the difference between CPU throttling and memory termination.
Field note
AWS KMS protects encryption keys, but erasure depends on key boundaries, data copies, recovery design and evidence that no usable route from ciphertext to plaintext remains.
Field note
Prepared statements prevent SQL values from becoming executable query structure, but safe database access also requires controlled identifiers, explicit authorisation, least-privilege accounts, transactions, timeouts and careful handling of dynamic queries.
Field note
AWS Transit Gateway turns many VPC and hybrid connections into a Regional routing architecture. Its attachments, route-table associations, route advertisements, segmentation, inspection paths and operational ownership determine which networks can communicate and how.
Field note
AWS PrivateLink lets consumers reach a specific service through private endpoints without creating general routed connectivity between the consumer and provider VPCs. This changes the network contract from joining address spaces to publishing one controlled capability.
Field note
Application Load Balancer and Network Load Balancer solve different forwarding problems. Choosing between them begins with HTTP semantics, connection behaviour, TLS ownership, client identity, static addressing and private connectivity, not a product feature checklist.
Field note
Private workloads often need outbound access for container images, updates, external APIs and other dependencies. NAT gateways provide controlled IPv4 exits without creating direct inbound paths, but zonal, Regional, private and centralised models introduce different routing, availability, cost, capacity and observability decisions.
Field note
In Amazon VPC, public and private describe subnet routing rather than workload confidentiality. A public subnet has a direct route to an internet gateway; a private subnet does not. Actual exposure depends on addressing, security controls, listeners and the complete network path.
Field note
IP address management becomes an architectural concern once CIDR allocations span accounts, Regions, environments and network trust boundaries. Amazon VPC IPAM can encode allocation hierarchy, organisational ownership, compliance rules, overlap detection and capacity monitoring.
Field note
IPv6 expands an IP address from 32 to 128 bits, but the architectural change is larger than the number. Address planning moves away from squeezing hosts into tiny subnets and towards hierarchy, route control, workload identity, cloud-provider constraints and deliberate transition from IPv4.
Field note
The same IPv4 CIDR block does not provide the same assignable capacity across AWS, Azure and Google Cloud. Understanding provider-reserved addresses, range types, minimum subnet sizes and service consumption prevents deceptively small capacity mistakes.
Field note
IPv4 subnetting does not require memorising a collection of disconnected masks and block sizes. Starting with capacity, powers of two and valid boundaries provides a repeatable method for designing CIDR allocations.
Field note
IPv4 subnetting becomes easier to reason about when addresses, masks and prefixes are understood as 32-bit binary values. This article builds from binary place values to CIDR ranges, subnet allocation, route aggregation and AWS VPC sizing.
Field note
AWS authorization is not a contest between policy documents. Identity and resource policies provide grant paths, permissions boundaries limit individual IAM entities, SCPs and RCPs impose organisational ceilings, and applicable explicit denies determine the result.
Field note
IAM Identity Center provides central workforce access to AWS accounts and applications. Delivery automation, runtime workloads and customers require different trust, authority, lifecycle and evidence models.
Field note
Service Control Policies can affect every governed identity and workflow using principals in their member-account scope. Testing must therefore verify intended denials, required permissions, complete service journeys, recovery paths and staged rollout.
Field note
AWS Service Control Policies define the maximum permissions available to affected principals in member accounts. They do not grant access. Used carefully, SCPs turn organisational invariants into tested, explainable and maintainable guardrails.
Field note
An AWS account is not merely a billing container or a folder for resources. It creates boundaries around identity, administration, quotas, cost, data, change and failure, making account design one of the earliest architectural decisions in a multi-account platform.
Field note
A multi-account AWS environment should begin with organisational boundaries, account responsibilities, policy inheritance and delegated administration. Networks, clusters and workloads become safer to build once the organisation around them has been designed.
Year
7 entries
Field note
ITIL is often mistaken for ticket queues, change boards and process bureaucracy. Through an engineer's eyes, its more useful ideas concern services, value streams, operating responsibilities, incident learning, controlled change and continual improvement.
Field note
Multi-cloud design should create consistent organisational boundaries, developer journeys and operating evidence without forcing AWS, Azure and Google Cloud into an artificial service model limited to the features they happen to share.
Field note
Application health depends on clusters, controllers, deployment systems, identity, networking, telemetry pipelines and shared services. Platform observability makes those dependencies visible through product promises, user journeys, control-plane signals and clear ownership.
Field note
Zero trust replaces broad, location-based trust with explicit identity, bounded authority, protected communication, enforceable policy and evidence that access can be reviewed and withdrawn.
Field note
A backup job proves that data was copied somewhere. Only a tested recovery path proves that the data, keys, configuration, dependencies and operating knowledge can recreate a usable service after failure.
Field note
Cloud governance should protect organisational boundaries, data, cost and reliability without turning every ordinary engineering decision into a ticket, meeting or manual approval. The strongest controls are clear, automated and built into supported delivery paths.
Field note
Blast radius describes the potential scope of impact that a failure, compromised identity, faulty deployment or operational mistake can reach before effective containment intervenes.
Year
6 entries
Field note
Self-hosting platform tools can improve control, portability and learning, but it also transfers availability, security, upgrades, recovery and support into the organisation. The software may be free; operational ownership is not.
Field note
Service-level objectives turn reliability from an abstract ambition into a measurable engineering decision. They define the user experience a service should provide, quantify acceptable failure and give teams a shared basis for balancing delivery with operational risk.
Field note
OpenTelemetry separates application instrumentation from telemetry storage. Services can emit traces, metrics and logs through common APIs and protocols while collectors route those signals to backends chosen by the platform.
Field note
A golden path makes the common, safe route through an internal platform easy to discover and use. It guides teams towards supported outcomes without pretending that every workload has identical needs.
Field note
An internal platform behaves like a product only when it solves recurring developer problems through usable interfaces, dependable capabilities, clear ownership and evidence that teams can succeed without navigating the underlying infrastructure themselves.
Field note
GitOps uses version-controlled declarations as the approved source of desired state and relies on automated reconciliation to bring running environments towards them.
Year
8 entries
Field note
A useful Terraform module packages a coherent infrastructure decision behind a small, stable interface. Reuse comes from clear ownership, sensible defaults and predictable lifecycle behaviour, not merely from moving resources into another directory.
Field note
Logs preserve detailed events, metrics reveal behaviour across time and traces reconstruct work across service boundaries. Observability becomes useful when those signals share enough context to support one investigation.
Field note
A CI/CD system does more than copy software into an environment. It gathers evidence, enforces policy, promotes immutable artefacts, changes desired state and uses runtime feedback to decide whether delivery should continue.
Field note
Cloud IAM decides who may act, which authority they may use, what that authority permits and under which conditions the platform should trust the request.
Field note
Infrastructure as Code turns infrastructure intent into reviewable, repeatable configuration. Declarative tools compare that intent, remembered resource identity and remote observations to calculate the changes required.
Field note
Containers package and constrain processes. Kubernetes adds a control plane that records desired state, schedules workloads across machines and continually reconciles the cluster towards that state.
Field note
A standard Linux container is not a miniature virtual machine. It is a process, or group of processes, running on a shared Linux kernel with selected views, resources and privileges isolated.
project
bfstore is my production-shaped engineering project for exploring how a business idea becomes software that can be built, deployed, secured, operated and evolved.
Year
6 entries
Field note
A database transaction can make local changes atomic. Once an operation crosses services, brokers and external providers, consistency depends on local commits, durable messages, idempotency, workflow state and reconciliation.
Field note
Distributed operations are often delivered or attempted more than once. Idempotency gives repeated attempts one stable identity and prevents them from multiplying the intended business effect.
Field note
Event-driven architecture connects producers and consumers through facts about completed changes. The useful design work lies in ownership, delivery, ordering, replay and recovery rather than the broker-shaped box.
Field note
Timeouts limit waiting, deadlines bound the complete operation and retries spend part of that finite budget on additional attempts. Used carelessly, all three can turn uncertainty into overload.
Field note
Designing the Protobuf service and message contract before implementation makes ownership, compatibility and interaction semantics visible while they are still inexpensive to change.
Field note
Separating an application into services can create valuable ownership, deployment and scaling boundaries, but every network boundary introduces latency, partial failure and operational cost.
Year
6 entries
Field note
Caching can make repeated reads faster and protect an expensive data source, but every cached copy creates questions about freshness, invalidation, failure and ownership.
Field note
Thinking about data ownership as the right to define meaning, enforce rules and control changes, rather than simply the location of a database table.
Field note
Comparing direct APIs, remote procedure calls and messaging by the contracts they create around timing, coupling, acknowledgement, delivery and failure.
Field note
Following a Linux process from creation and program execution through scheduling, signals, termination and the parent's final wait.
Field note
Taking a useful Bash command and adding explicit interfaces, validation, failure handling, cleanup, idempotence and operational safety.
Field note
Bash becomes much more useful when I stop treating it as a command prompt and start using it to coordinate commands, processes, streams, failures and operating-system tools.
Year
4 entries
Field note
A first relational database mental model: tables hold structured data, keys give rows identity and relationships, and indexes help the database find them efficiently.
Field note
Following an HTTP request from a URL to a response to understand what clients and servers actually exchange beneath the browser.
Field note
Following a piece of application data through transport, IP, Ethernet and routers to understand what actually travels between two networked hosts.
Field note
Following a Linux program from a command typed into Bash, through command lookup and exec, into memory, dynamic linking, execution and finally process termination.