Hidekazu Konishi - Profile / Biography | hidekazu-konishi.com

AWS Security Defaults History - Block Public Access, Default Encryption, IMDSv2, and How Far Each Changed Default Reached | hidekazu-konishi.com A timeline of the days AWS changed a security-related default, built only from primary sources, together with…

Amazon Linux History and Timeline - Amazon Linux AMI, Amazon Linux 2, AL2023, AL2027, and the Clocks That Do Not Move Your Instances | hidekazu-konishi.com A timeline of the four generations of Amazon Linux built only from officially published dates, cove…

Certificate Distribution in Kubernetes with AWS Private CA - Issue, Request, Store, Consume, and the Layer Where Renewal Stops | hidekazu-konishi.com Why a certificate that cert-manager renewed on schedule can still take internal traffic down, split across

Internal Developer Platforms on AWS - What Narrows the Choices, What Enforces the Permissions, and What Still Gets Around Both | hidekazu-konishi.com Why listing a product in a catalog narrows the choices without narrowing anyone's permissions, and what a…

Sharing One GPU on Amazon EKS - Where the Split Is Declared, Where It Is Enforced, and What Each Method Leaves Shared | hidekazu-konishi.com Why the same nvidia.com/gpu line can mean four different things and what each way of splitting a single GPU actual…

Controlling How Much a Model Thinks - Why the Same Request Means Different Things Across Model Generations, and What the Output Cap Actually Counts | hidekazu-konishi.com Why the same request body means different things across model generations, and what…

Orchestrating Regional Failover with Amazon Application Recovery Controller Region Switch - What Plan Evaluation Checks, Which Region the Plan Runs From, and What a Green Status Does Not Guarantee | hidekazu-konishi.com How ARC Region switch turns a switc…

Continuous Profiling on AWS - Which Clock the Flame Graph Is Showing You, What Runtime Metrics Cannot Replace, and What Sampling Never Sees | hidekazu-konishi.com How to read where time goes inside a production process, and where that reading goes wrong -…

Synthetic Monitoring and Real User Monitoring on AWS - What a Canary Run Proves, What a Real Session Proves, and What Neither One Can Tell You | hidekazu-konishi.com What each half of AWS application monitoring can and cannot establish - what a CloudWatch…

Terraform and OpenTofu History and Timeline - A License Clause, a Fork, a Foundation, and an Acquisition | hidekazu-konishi.com Terraform and OpenTofu exist side by side because of a license clause rather than a technical difference - the announcement on…

Observability and OpenTelemetry History and Timeline - Competing Specifications, a Foundation Merger, and the Path to a Single Standard | hidekazu-konishi.com Instrumentation had to be rewritten twice because two vendor-neutral specifications stood side by

CI/CD Tools History and Timeline - Trademarks, Acquisitions, Foundations, and Where the Build Runs | hidekazu-konishi.com What has broken the lineage of CI/CD tools is ownership and governance rather than technology - the trademark that forced the Hudson…

Change Data Capture on AWS Beyond Zero-ETL - Logical Decoding, Streaming Connectors, and the Guarantees Each Capture Point Gives You | hidekazu-konishi.com When the destination is not Amazon Redshift or Amazon OpenSearch Service, and the work is steady-st…

The Iceberg Catalog Layer on AWS - Catalog Federation, the REST Catalog API, and Scoped Credential Vending | hidekazu-konishi.com Adopting Apache Iceberg is settled in most organizations, and the argument has moved to the catalog: which side is allowed to…

PostgreSQL Autovacuum, Bloat, and Planner Statistics on Aurora and RDS - Why the Defaults Stop Being Enough, and What to Tune First | hidekazu-konishi.com A production database whose availability design is finished can still get slower, because what degra…

Data Pipeline Orchestration on AWS - What Carries Over, What the Runtime Makes You Rebuild, and Who Owns the Airflow Version | hidekazu-konishi.com You can carry a DAG definition from a self-managed Apache Airflow into Amazon MWAA.

Running Windows Server Workloads on AWS - What Carries Over, Why the License Decides the Tenancy, and Which Path Into the Domain | hidekazu-konishi.com Windows Server has no License Mobility, so a license you carry over has to land on hardware dedicated to

Running VMware Workloads on AWS with Amazon EVS - What Carries Over, What the VPC Makes You Rebuild, and Who Installs VCF | hidekazu-konishi.com Amazon Elastic VMware Service runs VMware Cloud Foundation on EC2 bare metal instances inside your own VPC, wh…

Detection Engineering on AWS - What a Custom Source Must Satisfy Before a Detection Can Be Written, and What the Detection Still Does Not See | hidekazu-konishi.com Collecting logs and being able to write a detection rule are two different jobs, and most…

Workload Isolation Levels on Amazon EKS - Which Level You Stopped At, and What That Level Does Not Stop | hidekazu-konishi.com Saying that tenants are isolated by containers says nothing on its own, because isolation on Amazon EKS comes in levels and the…

Agentic Payments on AWS - Where the Spending Limit Is Enforced, and What It Does Not Stop | hidekazu-konishi.com Telling an agent not to overspend is not a control, because an instruction is an input to the model and an input to the model is something an…

Programming AWS Trainium with the Neuron Kernel Interface - What the Compiler Stops Deciding for You, Which Names Do Which Jobs, and When Not to Descend | hidekazu-konishi.com Why descending below the framework onto AWS Trainium is not a way to make a mod…

Distributed Training Resilience on AWS - Where the Checkpoint Lives, How Far a Failure Sends You Back, and What Each Mechanism Requires | hidekazu-konishi.com Why the number that matters after a training failure is not how many minutes the outage lasted b…

Model Customization on Amazon Bedrock - What Each Method Demands as Input, and What It Takes to Call the Model You Built | hidekazu-konishi.com Why "RAG or fine-tuning" gets the number of options wrong, and how the three customization methods on Amazon Be…

AWS History and Timeline regarding AWS Network Firewall - Overview, Functions, Features, Summary of Updates, and Introduction | hidekazu-konishi.com A single ascending timeline of AWS Network Firewall, with every entry dated against a primary source - why…

AWS History and Timeline regarding AWS Shield and AWS Firewall Manager - Overview, Functions, Features, Summary of Updates, and Introduction | hidekazu-konishi.com A single ascending timeline of AWS Shield and AWS Firewall Manager, with every entry dated…

AWS Network and Application Protection Decision Guide - Where AWS WAF, AWS Shield, AWS Network Firewall, and AWS Firewall Manager Sit on the Request Path and What Each One Does Not Stop | hidekazu-konishi.com Why AWS WAF, AWS Shield, AWS Network Firewall,…

Sharding Aurora PostgreSQL with Limitless Database - Table Types, Shard Keys, Single-Shard Optimization, and What You Cannot Change Later | hidekazu-konishi.com What is left to decide once Amazon Aurora PostgreSQL Limitless Database has divided your datab…

Batch and HPC Job Scheduling on AWS - Job Queues, Fair-Share Policies, Multi-Node Parallel Constraints, and the Slurm Route | hidekazu-konishi.com What decides whether your jobs belong in a queue or on a cluster on AWS - why the answer is not scale but wh…

Amazon EFS Performance Engineering - Throughput Modes, IOPS Ceilings, Per-Client Limits, and Burst Credits | hidekazu-konishi.com Why a slow Amazon EFS file system is never one problem - the official performance specification table read by column so that…

Data Quality and Data Contracts on AWS - Where to Evaluate, What Each Failure Action Does to Your Data, and Why the Default Is to Keep Going | hidekazu-konishi.com What actually decides whether a failing data quality check stops your pipeline on AWS - why…

Running Apache Spark on AWS - Where the Billed Clock Starts, What Gets Measured, and What You Rewrite When You Move a Job Between EMR Serverless, EMR on EKS, and AWS Glue | hidekazu-konishi.com What moving the same Apache Spark job between Amazon EMR Serv…

Apache Iceberg V3 on AWS - Which Engines Read Format Version 3, Where the Official Support Matrices Disagree, and What to Check Before You Upgrade | hidekazu-konishi.com What raising an Iceberg table from V2 to V3 asks of every engine that touches it - wh…

Cloud Data Warehouse History and Timeline - Separation of Storage and Compute, Open Table Formats, and Convergence with the Data Lake | hidekazu-konishi.com A cross-vendor timeline of the cloud data warehouse as a category, from the BigQuery preview of May

AWS History and Timeline regarding Amazon Athena - Overview, Functions, Features, Summary of Updates, and Introduction | hidekazu-konishi.com A timeline of Amazon Athena from its general availability on November 30, 2016, read as three premises that the l…

AWS History and Timeline regarding AWS Glue - Overview, Functions, Features, Summary of Updates, and Introduction | hidekazu-konishi.com A timeline of AWS Glue from its announcement on December 1, 2016 to version 6.0, read as three tracks that moved at di…

Load Testing on AWS - Which Policy Actually Applies, Why the Load Generator Runs Out First, and What a One-Minute Metric Hides | hidekazu-konishi.com What binds before the system under test does, when a load test runs on AWS - the separate documents that…

Transaction Isolation on AWS Databases - Same Level Name, Different Anomalies, and the Statement That Changes Nothing | hidekazu-konishi.com What an application loses when it moves to another database engine, in the one dimension a row-by-row validation c…

What AWS Transform Automates and What Stays Human - Agentic and Self-Directed Paths, the Handoff Points That Are Designed In, and What Functional Equivalence Testing Actually Covers | hidekazu-konishi.com Where to draw the line in a migration plan between…

eBPF on Amazon EKS - What Loads Into Your Nodes, When a Network Policy Starts Enforcing, and Where the Coverage Stops | hidekazu-konishi.com Writing a NetworkPolicy in Amazon EKS does not put the decision anywhere near the API server.

Gang Scheduling and Dynamic Resource Allocation on Amazon EKS - Why One Half of the Vocabulary Is Still Alpha, and What Decides Which Device Allocation Path You Get | hidekazu-konishi.com A distributed job that is Running and not progressing is the same f…

Life After Ingress NGINX on Amazon EKS - Where the Upstream and AWS Disagree About the Order of Migration, and What GatewayClass Actually Decides | hidekazu-konishi.com Ingress NGINX was archived, and what that ended is the maintenance rather than the ope…

Policy Engines Compared - What IAM, Cedar, Rego, and Kyverno Do When Nothing Matches, When an Input Is Missing, and When the Engine Never Answers | hidekazu-konishi.com Four systems are all called policy engines, and the same word deny promises something…

Hardening GitHub Actions for AWS Deployments - Workflow Permissions, Untrusted Triggers, Action Pinning, and What the Trust Policy Cannot Catch | hidekazu-konishi.com The workflow file that deploys to AWS holds production write privilege and gets read less

Passkeys and WebAuthn in Practice - Discoverable Credentials, Synced Versus Device-Bound Keys, and Why Account Recovery Decides the Design | hidekazu-konishi.com The hard part of adding passkeys is not the cryptography - it is deciding where the key ends…

LLM Weight Quantization on AWS - Weight-Only and Activation Formats, What Each Costs in Accuracy, and When the Platform Quantizes for You | hidekazu-konishi.com You picked an open-weight model, it does not fit, and the format names line up without telling…

Speculative Decoding and Draft Models on AWS - Acceptance Rates, Which Methods Preserve the Output Distribution, and What the Managed Draft Model Takes Away | hidekazu-konishi.com Every source says speculative decoding costs you nothing in quality, and th…

Reproducible LLM Inference - Batch Invariance, the Cost of Determinism, and Where Bitwise Identity Is Actually Required | hidekazu-konishi.com Why the same prompt at temperature zero does not return the same tokens - the cause is neither GPU concurrency n…

Amazon MSK Broker Types and Storage Tiers - What Standard Brokers, Express Brokers, and MSK Serverless Each Take Away | hidekazu-konishi.com Choosing how to build a cluster in Amazon MSK is choosing the range of work AWS takes over rather than choosing fe…

Heterogeneous Database Migration on AWS - Schema Conversion, Full Load with CDC, Data Validation, and a Cutover You Can Reverse | hidekazu-konishi.com Moving a commercial database onto an open source engine on AWS is a design problem about time rather than