Hidekazu Konishi - Profile / Biography | hidekazu-konishi.com

Zero-ETL Integrations on AWS - The Source and Target Matrix Across Amazon Redshift, AWS Glue, and Amazon OpenSearch Service | hidekazu-konishi.com Zero-ETL on AWS is not one feature but three lineages split by whether the data moves at all, and the matrix…

Identity Lifecycle for AI Agents - Registration, Delegated Authorization, Access Review, and What Retirement Leaves Behind | hidekazu-konishi.com How to run an AI agent identity all the way from registration to retirement, and why an agent identity is a t…

AWS IAM Inbound Workload Federation - IAM Roles Anywhere, OIDC, and SPIFFE Converging on One Trust Policy Condition | hidekazu-konishi.com How a workload outside AWS obtains AWS credentials without a long-lived access key, and why all three entry paths end

Identity-Aware Data Access on AWS - Propagating Workforce Identity from IAM Identity Center to Lake Formation and S3 Access Grants | hidekazu-konishi.com How the identity of a signed-in person reaches the data layer on AWS without collapsing into a shared…

Migrating to the Stateless Model Context Protocol - What Breaks in Session-Based Servers and What Replaces It | hidekazu-konishi.com What the 2026-07-28 Model Context Protocol revision changed is where state is kept rather than how fast the protocol runs -

Express Mode and Pre-Deployment Validation in AWS CloudFormation - What Completion Stopped Meaning, What Rollback Now Defaults To, and Which Checks Silently Skip | hidekazu-konishi.com What AWS CloudFormation express mode and pre-deployment validation cha…

Disaggregated Prefill and Decode for LLM Serving on AWS - The KV Transfer, the Routing Threshold, and What Disaggregation Does Not Fix | hidekazu-konishi.com What splitting the two phases of LLM inference onto separate GPU pools actually adds to your oper…

Amazon EKS Control Plane Configuration - What You Can Set, What Blocks the Way Back, and How Far Each Setting Reaches | hidekazu-konishi.com How to treat the Amazon EKS control plane as a change-management problem rather than a parameter list - what the f…

AI-Assisted Security Testing on AWS - What You Approve, What You Can Only Stop, and What the Findings List Hides by Default | hidekazu-konishi.com How to design the receiving side for AWS Continuum and AWS Security Agent instead of treating an autonomous…

Threat Detection for AI Workloads on AWS - What GuardDuty AI Protection Detects, What It Does Not, and How to Read a Finding | hidekazu-konishi.com How to design the detection side for AI workloads on AWS instead of stopping at the controls that block an…

AI Bill of Materials on AWS - Discovering Models, Agents, and External Endpoints | hidekazu-konishi.com How to answer what AI is running in your organization by discovering assets from the running environment instead of trusting a self-declared catalog -…

Software Supply Chain Security on AWS - Signing, Attestation, and Admission Control | hidekazu-konishi.com What it takes to prove that a container image came from your own build on AWS and to enforce that proof before it runs - the chain of trust from dep…

Amazon EKS Capabilities - Managed Argo CD, ACK, and kro, and What Changes When the Controllers Move Off Your Cluster | hidekazu-konishi.com What the managed Argo CD, AWS Controllers for Kubernetes, and kro capabilities take over from a self-managed EKS pl…

Agent Sandboxing and Blast-Radius Isolation on AWS - Choosing the Unit of Each Containment Boundary and What Each One Does Not Stop | hidekazu-konishi.com How to contain an AI agent on AWS by choosing the unit of five boundaries - execution environment, c…

AWS IAM AccessDenied Reference - Reading the Error and Locating the Deciding Statement | hidekazu-konishi.com A reverse index from the wording of an AWS access denied message to the place to look next: every context clause AWS documents for the eight poli…

OWASP Top 10 for Large Language Model Applications Mapped to AWS Controls - What Each Control Covers, Where It Stops, and What the Application Still Owns | hidekazu-konishi.com A per-entry mapping from the OWASP Top 10 for LLM Applications (LLM01 to LLM10,

AWS IAM Outbound Identity Federation - Issuing Short-Lived Tokens from AWS to External Services | hidekazu-konishi.com A design guide to the direction of federation where AWS is the issuer: the account issuer URL and JWKS endpoints, every claim AWS STS pu…

The Boundaries of the AWS Global Network - Autonomous Systems, Partitions, and What a Private Path Does Not Guarantee | hidekazu-konishi.com A definitional guide to what an AWS network path does and does not guarantee: reachability on the AWS global netwo…

How Elastic Load Balancing Scales - Scaling Rate, Capacity, and Load Balancer Capacity Unit Reservation | hidekazu-konishi.com A design guide to preparing Elastic Load Balancing for a traffic spike: why scaling rate and total capacity are separate problem…

OpenTelemetry-Native Observability on AWS - OTLP Ingestion, PromQL, and the X-Ray SDK Transition | hidekazu-konishi.com A migration guide for teams already running CloudWatch: how OTLP ingestion and PromQL change the backend, how the OTLP resource, scope,…

VPC Encryption Controls - Auditing and Enforcing Encryption in Transit | hidekazu-konishi.com A guide to demonstrating that no unencrypted traffic exists inside a Region with Amazon VPC Encryption Controls: the encryption layers, the flow log encryption-s…

OWASP Top 10 for Agentic Applications Mapped to AWS Controls - What Each Control Mitigates and What Residual Risk Remains | hidekazu-konishi.com A per-entry mapping from the OWASP Top 10 for Agentic Applications (ASI01 to ASI10, Version 2026) to AWS contr…

Surviving Forced Maintenance on AWS - Retirements, Grace Periods, and Health-Driven Operations | hidekazu-konishi.com A cross-service reference for the maintenance AWS applies to resources that are already running: the notify, grace, and enforce shape sha…

AWS Lambda Managed Instances - Capacity Providers and the Multi-Concurrency Trap | hidekazu-konishi.com A design guide for AWS Lambda Managed Instances that treats multi-concurrency as the primary gate, covering capacity providers as a trust boundary, the…

AWS Service Lifecycle States - Maintenance, Sunset, Full Shutdown, and What Each One Takes Away | hidekazu-konishi.com A reference for the three lifecycle states AWS defines for services and features: what Maintenance, Sunset, and Full Shutdown each take…

Zero-Downtime Database Change on RDS and Aurora - Blue/Green Deployments, Upgrades, and Rollback Design | hidekazu-konishi.com A design guide to applying changes to Amazon RDS and Amazon Aurora with the shortest possible write-stop window: choosing a meth…

Threat Modeling Generative AI Applications on AWS - STRIDE for RAG, Agents, and Tool Use | hidekazu-konishi.com A threat modeling method for generative AI applications on AWS: the asset inventory specific to this class of system, where the trust boundaries

Content Provenance for AI-Generated Media - C2PA, Watermarking, and Machine-Readable Marking | hidekazu-konishi.com A practitioner's guide to content provenance for generated media, checked against the C2PA technical specification 2.4: what a valid Content

AWS IAM Access Analyzer Deep Dive - External, Internal, and Unused Access Analyzers with Custom Policy Checks in CI | hidekazu-konishi.com A design guide to IAM Access Analyzer - how the external, internal, and unused access analyzers differ in what they…

Amazon FSx Family Decision Guide - Choosing Between Lustre, NetApp ONTAP, OpenZFS, and Windows File Server | hidekazu-konishi.com A decision guide for the Amazon FSx family that starts from your own input conditions - existing storage estate, required pro…

Amazon EBS Performance Engineering - Volume Types, io2 Block Express, Snapshot Initialization, and Multi-Attach | hidekazu-konishi.com A design guide to Amazon EBS performance - the three layers that bound it, how each volume type derives its IOPS and thr…

Amazon GuardDuty Extended Threat Detection Architecture - Attack Sequences, Runtime Monitoring, and Response Automation | hidekazu-konishi.com A design guide to Amazon GuardDuty Extended Threat Detection: how attack sequences correlate weak signals into a…

AWS Nitro Enclaves and Confidential Computing on AWS - Attestation, PCR Measurements, and KMS Condition Keys | hidekazu-konishi.com A Level 400 guide to AWS Nitro Enclaves: the isolation model and its threat model, how an enclave image is built and measur…

AWS Private CA Hierarchy Design - Root and Subordinate CAs, Revocation, Short-Lived Mode, and mTLS on ALB | hidekazu-konishi.com A Level 300 guide to private PKI design on AWS: the CA properties that cannot be changed after creation, root and subordinate…

Amazon CloudWatch Alarm Design and Alert Fatigue - Composite Alarms, Anomaly Detection, Metric Math, and Metric Cardinality | hidekazu-konishi.com A Level 300 guide to Amazon CloudWatch alarm design and alert fatigue: classifying what deserves to page a h…

AWS Systems Manager Fleet Operations at Scale - Patch Manager, State Manager, Automation Runbooks, and Session Manager | hidekazu-konishi.com A Level 300 guide to operating EC2 and hybrid fleets with AWS Systems Manager: the three conditions that make a n…

Chaos Engineering on AWS with AWS Fault Injection Service - Experiment Design, Stop Conditions, and Safety Rails | hidekazu-konishi.com A Level 400 design guide to chaos engineering on AWS with AWS Fault Injection Service, covering steady state and hypoth…

Elastic Fabric Adapter and the AWS Network Fabric - SRD, ENA Express, and Placement Group Design | hidekazu-konishi.com A Level 400 guide to network design for tightly coupled workloads on AWS: what Scalable Reliable Datagram changes, how EFA and ENA Expr…

AWS Data Movement Decision Guide - DataSync, Transfer Family, Storage Gateway, and Data Transfer Terminal | hidekazu-konishi.com A decision guide for moving data into AWS that starts from your input conditions rather than service names, covering AWS DataS…

Designing for Spot Interruptions on AWS - Allocation Strategies, Rebalance Signals, and Graceful Degradation | hidekazu-konishi.com A design guide to running workloads on interruptible Amazon EC2 capacity: the rebalance recommendation and the two-minute i…

Cell-Based Architecture and Shuffle Sharding on AWS - Blast Radius Reduction Patterns for Large-Scale Workloads | hidekazu-konishi.com A Level 400 implementation guide to cell-based architecture and shuffle sharding on AWS, covering cell design, partition…

Major Security Vulnerabilities History and Timeline - Disclosure, Impact, and the Response Practices They Changed | hidekazu-konishi.com Major security vulnerabilities history and timeline covering Heartbleed, Shellshock, POODLE, DROWN, Log4Shell, Spring4…

LLM Output Verification Patterns - Grounding Checks, Self-Verification, Cross-Model Review, and Citation Enforcement | hidekazu-konishi.com A vendor-neutral map of LLM output verification organized by error type rather than by technique, covering structur…

TLS Certificate Ecosystem History and Timeline - Certificate Authorities, Automation, and Shrinking Certificate Lifetimes | hidekazu-konishi.com TLS certificate ecosystem history and timeline covering certification authorities, the CA/Browser Forum Baseli…

AWS KMS Envelope Encryption and Data Key Caching Patterns - Design Decisions for the AWS Encryption SDK and Multi-Region Keys | hidekazu-konishi.com A design guide to envelope encryption on AWS - how data keys are generated and destroyed, what encryption…

OpenTelemetry GenAI Semantic Conventions Implementation Guide - Vendor-Neutral Instrumentation for LLM and Agent Applications | hidekazu-konishi.com A vendor-neutral implementation guide to the OpenTelemetry GenAI semantic conventions, transcribing the sp…

Email Authentication History and Timeline - SPF, DKIM, DMARC, and BIMI | hidekazu-konishi.com Email authentication history and timeline covering SPF, DKIM, DMARC, ARC, and BIMI - from SMTP without sender authentication and the IETF MARID working group, th…

Amazon EKS Pod Identity and IRSA Decision Guide - Workload Identity Design, Trade-offs, and Migration Paths | hidekazu-konishi.com A decision guide for Amazon EKS workload identity that compares EKS Pod Identity and IAM roles for service accounts, states…

Post-Quantum Cryptography Standardization Timeline and Migration on AWS - From Algorithm Selection to Service Support | hidekazu-konishi.com Post-quantum cryptography standardization timeline from the 2016 NIST call for proposals to FIPS 203, FIPS 204, and

Agent Reliability Engineering Design Guide - Retries, Loop Detection, Timeout Budgets, and Human Escalation for AI Agents | hidekazu-konishi.com A vendor-neutral design guide for the reliability of the AI agent execution loop: termination conditions, step…