Hi, I'm Nelson. I work at AWS in Dublin and build production infrastructure on the side. My day job is debugging customer workloads across EC2, ECS, IAM, and VPC. Outside of work, I've built a 6-stack CDK architecture, a self-hosted observability platform (Prometheus, Grafana, Loki, Tempo), and the CI/CD pipelines that keep them running. I write about the real problems I solve along the way.
I manage 4 CDK projects and 11 stacks from a single app.ts using project-specific factories, typed config modules, SSM-based discovery, and CDK Aspects. Here's how the pattern works and where it broke.
I wrote 30 custom Checkov rules in Python, wired them into a three-layer security pipeline with CDK-Nag and SARIF, and set up severity gating that warns in dev but blocks production. Here's the architecture and a real IMDSv2 bug it caught.
I deploy 4 CDK projects across 3 AWS accounts from a single GitHub repo using OIDC federation, a 465-line composite action, and environment-scoped Checkov scanning. 19 workflow files, zero long-lived credentials, and auto-rollback when smoke tests fail.
I run 7 Docker containers on one EC2 instance to get full metrics, logs, and traces for my ECS portfolio. Cloud Map DNS handles service discovery, SSM handles access, and the whole thing costs $15/month.
