Technical deep-dives on AWS cost optimization, cloud waste detection, and FinOps automation. Also as a podcast →
Most tools say they're read-only because their docs or their IAM role say so. Here is a small guard that makes the promise a property of the code: any AWS call that isn't a read is refused before it is sent. The pattern, the trap in making it loud, and what it does not protect you from.
Fourteen months building a hosted AWS cost tool, an eight week experiment with one metric, and a result of zero. Here's why nobody connects an account to a tool like this, and why the scanner now runs on your own machine instead.
Our daily anomaly sweep ran at 08:00 UTC on lagged cost data and only evaluated rows dated today. It evaluated zero services on every run, with no error. Here's the bug, the fix, and what to copy.
A green unit test proves your code does what you think AWS does. It can't prove AWS does it. Here's the fixture-and-control test we run against real resources, and what it found when we pointed it at one DocumentDB check.
I filed my own SR&ED claim. Rebuilding the technological uncertainty story from git history took three weeks. A two-line log would have saved them.
A deploy from a laptop and a deploy from CI landed 18 seconds apart. The pipeline went red — and production quietly kept running the OLD build anyway. The real bug wasn't the error message; it was that the error message never named the actual consequence.
AWS Cost Explorer's own data can lag up to 24 hours, and nobody's on call for 'the bill.' Here's the actual statistics behind CloudWise's daily anomaly scan — a real z-score threshold from the shipped code, and the exact test case that proves it catches a spike.
Our /dashboard cold start took 1,124ms. SnapStart was already on, already restoring in ~600ms — and it made zero measurable difference for two deploys, because of a log level and a hook that only half-did its job. Here's the actual debugging path, including the parts that didn't work.
CloudWise's onboarding flow can never touch your infrastructure — it only ever grants a bespoke, Get/Describe/List-only IAM role. Remediation lives in a separate, opt-in stack behind an explicit approval gate. Here's the actual IAM, not the marketing version.