Insights & Resources

July 2026: nine migration mistakes that still show up after Migration Hub closed to new customers on November 7, 2025, covering AWS Transform MGN (formerly AWS Application Migration Service), DMS, AWS Transform, Org/SCPs, FinOps dual-run costs, and Migration Lens.

On May 6, 2026, AWS made its managed MCP server generally available in 2 regions, with IAM guardrails, CloudWatch metrics, and CloudTrail logging, while the March 25, 2026 Agent Plugin for AWS Serverless brought packaged SAM/CDK skills into Cursor and Claude Code.

A guide to microservices patterns on AWS: what to use, what to skip, and what changed in 2026 (App Mesh EOL, VPC Lattice, Powertools idempotency, Step Functions sagas).

July 2026 Terraform command reference for AWS: Terraform 1.10+ plan/apply/state, use_lockfile, import/removed/ephemeral, and five checks to run on Monday morning that close real failure modes.

AWS just made OpenAI's frontier models, Codex, and production-ready Managed Agents available inside Amazon Bedrock, wrapped in IAM, PrivateLink, Guardrails, and CloudTrail. This is what changes for CTOs evaluating OpenAI direct vs. AWS.

Most teams buy Bedrock Provisioned Throughput too early or too late. This is the break-even math, by token volume, model family, and traffic shape, that we use in real FinOps engagements to decide which Bedrock pricing mode wins.

As of July 2026, Lambda S3 Files still mounts S3 as POSIX via NFS, at roughly S3 Standard storage rates vs EFS for large files. Versioning is required, IAM is s3files:*, capacity providers are incompatible, and a ~60s write-back window breaks naive ports.

July 2026 production walkthrough of Anton Babenko's Terraform Claude Skill on AWS (VPC, EKS, S3 + KMS, IAM OIDC) with measured scorecards, five gaps the skill still won't cover, and a reproducible eval harness.

Bedrock Automated Reasoning checks ground LLM outputs against formal logic policies you encode and mathematically validate that the response is consistent with the policy. This guide covers when to use Automated Reasoning vs contextual grounding, how to author the policy in production, the integration with Bedrock Guardrails, and the regulated use cases (HR, insurance, eligibility, regulatory determinations) where the difference matters.

Production CloudTrail: multi-region org trails, log validation, CMK, Lake + Athena. July 2026 checklist. Event History is not enough.

EBS default encryption per Region, CMK lifecycle, block public snapshots. July 2026 baseline checklist. Retrofit is expensive.

AWS IAM Identity Center is the AWS-native workforce SSO and identity-propagation service. This guide covers federation from Okta / Microsoft Entra ID, permission-set design, attribute-based access control (ABAC), identity propagation to Q Business / Redshift / QuickSight / S3 Access Grants, and the migration off long-lived IAM users.