A multi-account setup a two-to-twenty person team can run without a platform team: which accounts to create, three service control policies worth having on day one, human access through IAM Identity Center, and CI access through OIDC.
Read ArticleFour reasonable homes for an agent on AWS, chosen mainly by how long a session runs, whether it holds connections, and how much of the runtime you want to operate. A decision table, the limits that force the choice, and the IAM each one needs.
Read ArticleAsk a coding agent for an orchestrator role that launches ECS tasks and you will often get ecs:* and an unconditioned iam:PassRole. Here is the escalation path when a privileged role trusts ECS, the scoped version, and a checklist for reviewing agent IAM before merge.
Read ArticleCoding agents produce Terraform that plans cleanly and hides its risk in a few lines. Where to look in the diff, and a Conftest policy that fails the plan when an IAM statement allows iam:PassRole without a service condition.
Read ArticleAgent workloads rarely hit CPU limits. They hit the model provider's tokens-per-minute limit, then retry into it. How to put a queue, a concurrency cap and a shared token budget in front of the model so load turns into delay instead of failure.
Read Article