I use AWS all day every day at my day job, and our spending is in the range of a new Honda Accord, every month. I also have a personal AWS account, which I use for this blog and for any other hobby projects I might get into. My spending in the personal account is around $2/month. I have access to Claude Sonnet 4.6 in my personal account and it works great, but I’d like to stay current and I’d like to start using Claude Sonnet 5 via AWS Bedrock. But when I try to use Claude Sonnet 5 in the Bedrock Model Playground, for example, AWS tells me that I don’t have access to the model: ...

I’ve been using an HDHomeRun network TV tuner for years, and I just recently got an LG C5 OLED TV. Using the built-in apps on a smart TV is generally a terrible practice, and I will soon get all my content through a streaming box, but right now I haven’t purchased a streaming box so right now I have to use the LG built-in apps. My first thought about using the HDHomeRun TV tuner is that I can simply open the LG app store on the TV, find an HDHomeRun app, and I should be good to go. And a bit of Googling shows that an HDHomeRun app does exist, so it should be no problem, I thought. But when I searched for hdhomerun in the LG app store on my C5, I got no results. I even asked ChatGPT, and it’s response was basically “get a Roku, lol”. ...

If you’re an infrastructure engineer like I am, and if you use Terraform like I do, then your Terraform state files are some of the most important files you manage. If those files somehow disappeared, Terraform wouldn’t be able to know which resources it should manage, any subsequent terraform apply that you might run would probably fail (in the best case) and would maybe be actively destructive to your business (in the worst case). So you should be really careful to make sure your state files don’t disappear. ...

A common task I run into at work is I’ll need to iterate over some JSON in Bash. This is very easy to do in Python, but can be kind of annoying in Bash because sometimes your JSON is spread out over multiple lines, or sometimes your JSON values have whitespace or other special characters that get in your way when using Bash. In this post I’ll show some examples of how I handle it using jq. ...

There a bunch of ways that you can handle AWS Security Group rules in Terraform, including in-line rules with the aws_security_group resource or the old aws_security_group_rule resource, but the Terraform community recommends using aws_vpc_security_group_ingress_rule and aws_vpc_security_group_egress_rule as a best practice. But when you are creating resources for each individual rule, it can sometimes be difficult to keep them organized. For example, suppose you have an application with all of its resources and its security group defined in application.tf and you have a database with all of its resources and its security group defined in database.tf. And then suppose you need a rule which allows egress traffic from the app to the database, and you need a rule which allows ingress traffic to the database from application. It can be easy to place each rule in the “wrong” file and then six months later when you need to make a change you forgot which rule is in which file. Or if you have dozens of related rules in the same configuration, it can be annoying to give each rule a unique name that you’ll be able to remember later. ...

I recently changed jobs and inherited an infrastructure built with Terraform with an application which deploys to EC2 via AWS CodeDeploy. The ASG’s and target groups were all built and managed by Terraform, and CodeDeploy used In-Place deployments. In-place deployments means that the deployment automation does this: Stop the application on the existing servers, which brings the website down for customers Install the new version of the application on to the same existing servers Start the application Obviously, stopping the application and bringing the website down is a huge anti-pattern, so one of the first tasks assigned to me at the new job was to implement blue/green deployments, roughly like this: ...

I am a huge fan of high taxes (for the rich), and a common argument I hear against it is “If taxes are too high, nobody will open businesses! Why should someone do a bunch of work if they can’t reap the rewards?”. And I guess it sounds right intuitively, but it’s also factually dead wrong. Tons of companies got started when tax rates were way higher than they are today. In this blog post I’ll combine some data from various sources into a big table which shows the highest marginal tax rates when various companies got started. ...

Recently at work we started using AWS Network Firewall to meet a compliance objective, and in doing so I learned some of the tricks and gotchas around how to set up your network routing in various network architectures. AWS has some of this documented pretty well and some of it documented pretty terribly. In this post I’ll explain what I learned and hopefully the next person who Googles it will end up here. ...

The other day at work I had a need to use the AWS CLI to get a list of RDS snapshots (aws rds describe-db-snapshots), but I only wanted the snapshots where Status == "available". In true DevOps fashion, I googled for a one-liner that I could copy/paste instead of actually learning the query syntax myself, but apparently nobody has posted it anywhere on the internet. So if you’re in the same spot and you’re googling for “aws rds describe-db-snapshots status available” or similar, here it is: ...

AWS CodePipeline and AWS CodeBuild are a great, serverless way to build your Docker containers and deploy them to ECS (or wherever). You can even use an IAM role with CodeBuild to let your build pipeline access other services like S3, etc. AWS CodeBuild already provisions a container for you to use, and that’s where it runs all the commands in your buildspec file. But if you’re using CodeBuild to build a Docker container, then you’ll be running a container (the one you’re building) inside another container (the CodeBuild one, where your buildspec stuff runs). ...