Suhaib Chishti

Really excited to share something personal, I just published my first blog post on the AWS Architecture Blog! 🎉 Together with Aritra Nag and Manikanth M, we wrote about AI-powered event response for Amazon EKS. This one hits close to home because it combines two things I genuinely care about: Cloud Operations Architecture and Generative AI. The blog digs into AWS DevOps Agent and how it's changing the game for Kubernetes incident response. Instead of just alerting you when things break, it actually understands the relationships between your Pods, Deployments, Services, and ConfigMaps, then helps you figure out what went wrong and how to fix it. We walk through real testing scenarios, show how the agent correlates metrics, logs, and traces, and demonstrate how it identifies root causes with actual confidence scores. It's the kind of proactive operations approach I've been talking about with customers for years, now powered by AI. After more than a decade in this space, I am convinced this is where cloud operations is heading. AI that doesn't just tell you there's a problem, but actually helps you understand it, solve it, and prevent it from happening again. If you're dealing with Kubernetes at scale or just curious about where AI and operations are converging, I would love to hear what you think. Read the full blog here: https://lnkd.in/dWbE5b45 #AWS #CloudOperations #GenerativeAI #Kubernetes #DevOpsAgent #AmazonEKS #FrontierAgents

115

16 Comments

One of my favorite feature releases of this year from AWS Lambda team. You can't imagine how easy is this to setup. My Startup customers who love Lambda functions, here is something to look at when it comes to tenant isolation while building tenant-aware applications. I will agree that the person who made it very very easy for me to understand this feature is Anton Aleksandrov.. 👏. Lookout for a deep dive article from him on this topic soon.

23

1 Comment

Oracle Globally Distributed Exadata Database on Exascale Infrastructure Unleashed Oracle Globally Distributed Exadata Database on Exascale Infrastructure prioritizes lowering costs, enabling customers to run a variety of distributed workloads, including agentic AI, analytics, and transactional application. https://lnkd.in/gbdSU6Tk

4

Follow-up to my earlier post on secure agent sandboxes on EKS (https://lnkd.in/gDqdyJbu). That post solved isolation. This one solves speed without giving it up. EKS Fargate gives you serverless compute with AWS-managed isolation per pod — no nodes to patch, no capacity planning. The kubernetes-sigs/agent-sandbox operator adds warm pool semantics on top: pre-provisioned idle pods that are claimed instantly when a request arrives, then terminated and replenished after use. Sandbox checkout in under 5 seconds. Same container, same protocol, same security model — just faster. The post covers the SIG CRDs (SandboxTemplate, SandboxWarmPool, SandboxClaim), the API difference vs raw K8s Jobs, cost of idle pods, and Fargate considerations for this workload pattern. 📖 https://lnkd.in/guJfdEPd #AI #AWS #EKS #Kubernetes #Fargate #Serverless #GenAI #AIAgents #Sandboxing

8

SiliconANGLE - Red Hat aims new Developer Lightspeed AI features at application migration This week Red Hat launched Developer Lightspeed, a new generative AI tool, and MTA 8. The combined solution integrates AI-generated refactoring and automated replatforming to accelerate developers' migration of applications to the Red Hat OpenShift platform.

4

🚀 Simplifying Secrets Management in Amazon EKS with AWS Secrets Manager Agent🚀 Managing secrets securely in Kubernetes environments has always been a challenge — from language-specific SDK dependencies to complex secret rotations across multiple pods. In this newly published post by Sumanth Culli and Rakesh Shirke, AWS introduces a new approach — the AWS Secrets Manager Agent — that tackles these challenges head-on. 💡 Key Highlights: 🔹 Language-agnostic & lightweight: Retrieve secrets via a simple local HTTP endpoint (localhost:2773) — no SDK dependencies needed. 🔹 Improved availability: Secrets are fetched from an in-memory cache, reducing API calls and network latency. 🔹 Enhanced security: Built-in SSRF protection and Pod Identity authentication ensure secure secret retrieval without exposing credentials. 🔹 Post-quantum cryptography: Implements ML-KEM-based encryption for future-ready security. 🔹 Flexible deployment: Use as a sidecar container for isolated workloads or a DaemonSet for shared access. This solution complements the AWS Secrets and Configuration Provider (ASCP) for Kubernetes, offering a new path for teams who prefer HTTP-based secret access and dynamic refresh capabilities. 🔗 Read the full post to explore the implementation steps and choose the right approach for your EKS workloads: 👉 https://lnkd.in/gBC58D9p #AWS #EKS #Kubernetes #CloudSecurity #DevOps #AWSSecretsManager #Containers #CloudComputing #Security

18

Just as AI agents have compressed code creation costs to near-zero, secure-by-design infrastructure patterns compress compliance validation through pattern recognition, automated policy enforcement, and intelligent resource management - addressing the operational constraint of "does this security control break anything" before deployment. https://lnkd.in/gE9v6HPf

3

Amazon Elastic Kubernetes Service (Amazon EKS) now supports up to 100,000 worker nodes in a single cluster, enabling customers to scale up to 1.6 million AWS Trainium accelerators or 800K NVIDIA GPUs to train and run the largest AI/ML models. This capability empowers customers to pursue their most ambitious AI goals, from training trillion-parameter models to advancing artificial general intelligence (AGI). https://lnkd.in/g8-URjsm #EKS #AWS #Cloud #Kubernetes

20

2 Comments

AWS experienced a 15-hour disruption (plus a few additional hours for backlog reprocessing) in US-EAST-1, caused by a DNS resolution failure in DynamoDB. The issue cascaded into EC2 launch failures, Lambda invocation errors, and Network Load Balancer health check impairments, impacting multiple core and global services. This incident highlights how deep interdependencies in cloud ecosystems can amplify the impact of a single failure — and reinforces the need for resilient architecture, multi-region design, and automated incident response. Historical Context: June 2023: ~2-hour outage in US-EAST-1 December 2021: ~7-hour outage in US-EAST-1 I can imagine the pressure the engineering teams were under to restore services — probably 15hrs straight with just coffee 😊 . I hope they'll share a detailed Root Cause Analysis.

45

3 Comments

A new blog "Migrate to Amazon S3 account regional namespaces" I have co-authored with Ravi Kumar on the AWS Storage Blog! Since 2006, S3 bucket names have been globally unique, often leading to naming collisions and security concerns when deleted names could be claimed by others. With account regional namespaces (launched March 2026), bucket names are now scoped to your account and Region. Your preferred names are always available, and deleted names stay reserved for you. The blog walks through a migration approach using S3 Replication, along with how to enforce governance org-wide using SCPs. Existing buckets continue to work as-is, so you can migrate on your own timeline. Read the blog here: https://lnkd.in/d-dWrub9

36

2 Comments

There is lot of information available on what happened with recent outage at Cloudflare and how did it impact close to 30% internet traffic including entire postmortem published by Cloudflare themselves in blog post. Let me share what organizations should do to mitigate the single point of failure due to DNS issues. 𝗧𝗵𝗲 𝗮𝗻𝘀𝘄𝗲𝗿 𝗶𝘀 𝘀𝗶𝗺𝗽𝗹𝗲 - 𝗦𝗲𝘁𝘂𝗽 𝗱𝘂𝗮𝗹 𝗗𝗡𝗦 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗿𝘀 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗯𝗲𝗮𝘂𝘁𝘆 𝗶𝘀 𝗮𝗯𝗼𝘂𝘁 - "𝘄𝗵𝗮𝘁 𝗺𝗮𝗸𝗲𝘀 𝗶𝘁 𝘄𝗼𝗿𝗸?" -- T𝗵𝗲 𝗮𝗻𝘀𝘄𝗲𝗿 𝗶𝘀 𝗰𝗼𝗿𝗲 𝗗𝗡𝗦 𝗿𝗲𝘀𝗼𝗹𝘂𝘁𝗶𝗼𝗻 𝗶𝘁𝘀𝗲𝗹𝗳. Let's see how to set this up. In this illustration, we will consider Cloudflare and Amazon Web Services (AWS) Route 53 as DNS providers. By design, when you register multiple nameservers for your domain, DNS resolvers pick one randomly to query. If that nameserver doesn't respond, the resolver waits for a timeout (typically 2-5 seconds), then automatically tries the next one in the list. This isn't some clever hack - it's literally how DNS was designed to work. We're just using nameservers from different providers instead of all from one. The failover isn't instant. When Cloudflare's nameservers go down, that first query hits a 2-5 second delay before switching to Route 53. But then DNS resolvers get smart - they remember which nameservers are unresponsive and start avoiding them. After that initial hiccup, everything runs smoothly. The setup is straightforward --> maintain identical DNS records in both providers, then register all nameservers at your domain registrar. The DNS protocol handles the rest. The tricky part is keeping records synchronized across both systems. Looking at Terraform or OctoDNS to automate this. Not perfect, but it leverages the fundamentals of how DNS already works to eliminate a single point of failure. #DNS #Infrastructure #CloudEngineering #Reliability #DevOps #SystemDesign #ThePracticalArchitect

22

1 Comment

This past Saturday, I presented a deep dive on AWS Lambda Durable Functions at the AWS London Ontario User Group meetup. The presentation explores how Durable Functions work and how they compare to Step Functions and Temporal for workflow management. I also built a demo application, available on GitHub, so you can try it yourself. Links to our User Group YouTube channel and Meetup page are in the comments. Thank you very much to Ngwa Bandolo Bobga Cyril for organizing this session and all the previous ones! #AWSCommunity #AWSUserGroupLondonON https://lnkd.in/ePkmPQKG

68

5 Comments

Don't miss KubeCon + CloudNativeCon India and North America to learn about sharing GPUs among multiple containers in Kubernetes, a challenge addressed by Xiao Zhang. Discover solutions and practices for implementing GPU sharing, focusing on Dynamic Resource Allocation (DRA) and the CNCF sandbox project HAMi. #KubeCon #CloudNativeCon #Kubernetes #GPUsharing #DRA #HAMi #CNCF #cloudnative #AI #XiaoZhang #this_post_was_generated_with_ai_assistance #responsibleai https://kubecon.io

1

Did you know? Running Amazon EKS at a larger scale can lead to challenges related to IP address limits, impacting the number of pods that can operate on a node. 👉 https://lnkd.in/epH8e5Bn #AWS #Containers #Docker #CloudNative #PlatformEngineering #Kubernetes

94

12 Comments

Building AI is one thing - operating it reliably at scale is another. Observability plays a huge role here. Great to see Achievers and New Relic bringing this conversation to Toronto. Should be a very productive meetup for anyone building or operating modern systems. Register here -> https://lnkd.in/ewKWqFc2

1

Kubernetes Modernization - Driving Cost Optimization, Security & Operational Excellence Migrating to AWS EKS, Azure AKS and GCP GKE enables cost optimization through auto-scaling, right-sizing workloads, and improved resource scheduling. Security improves with RBAC, network policies, secrets management, and policy enforcement. Built-in self-healing, multi-zone deployments, and rolling updates enhance redundancy and availability. Automation, GitOps, and observability integration drive true operational excellence and reliability. Kubernetes is evolving into the backbone of modern, scalable cloud platforms. #Kubernetes #CloudNative #DevOps #PlatformEngineering #SRE #CostOptimization #CloudSecurityDriving Cost Optimization, Security & Operational Excellence

6