Writing about development, cloud architecture, and lessons learned building for the web.
How OIDC federation replaces long-lived AWS access keys in CI — and the four things that broke before it worked. Subject strings, IAM scope, a shared provider, and who gets to mint a token.
My blog index returned an S3 AccessDenied XML instead of a page. The cause was a routing rule nobody writes down: in a hybrid Astro build behind CloudFront, a prerendered child route can make its SSR parent unreachable.
The original version of this post listed three features I was about to build. None of them shipped. Here is what the stack actually is, what production asked for instead, and why the config is the interesting part.
The hello-world Lambda takes four minutes. Everything that actually costs you time is downstream of it — IAM that fails at runtime, service sandboxes that shape your code, and cold starts that are worst exactly where the marketing is loudest.
This site shipped a working theme toggle that only changed three components. The CSS custom properties were all correct — they were just barely used. What that cost, how I measured it, and why the fix had to render byte-identically.