Terraform rebuilds a console-built AWS account from prod — read-only spec, parity diff, GitHub OIDC
Codifying a console-built AWS data layer in Terraform from a read-only capture of prod, verified by a config diff and run through GitHub OIDC.
AWS
Bedrock structured outputs stop at Claude 4.6 — a prompt rule and error feedback for Sonnet 5
Amazon Bedrock rejects strict tool use on Claude Sonnet 5. A prompt rule and a tool_result error retry kept translation JSON valid without it.
A GitHub Actions job that mints its own Cognito M2M token to test what it just deployed
GitHub OIDC gives CI an AWS identity, but a JWT-authorized MCP endpoint needs a second one: a Cognito client_credentials token read from terraform output.
Bedrock DELETE_UNSUCCESSFUL — the knowledge base needs its OpenSearch collection to delete
Two Amazon Bedrock knowledge bases stuck at DELETE_UNSUCCESSFUL after their OpenSearch Serverless collections were deleted first, and the RETAIN fix.
Two SQL shapes that stopped a text-to-SQL agent doing arithmetic in prose — ROLLUP and scalar subqueries
A text-to-SQL agent broke a written rule against adding rows by hand. GROUP BY ROLLUP and scalar subqueries fixed it by deleting the step, not the rule.
_override.tf runs committed Terraform in a sandbox — and apply caught what validate missed
Gitignored Terraform override files retarget a committed config at your own AWS sandbox: a local backend, overridden locals, and what only apply found.
Deploying an MCP server on Bedrock AgentCore — Cognito OAuth, and a benchmark that lied
Deploying a Python MCP server on Bedrock AgentCore with Cognito OAuth: the IAM action that is not InvokeModel, and a 225x benchmark that was really 2.3x.
Granted on Windows swaps a plaintext AWS key for SSO — and be aware of the two AWS logins
Granted and AWS IAM Identity Center replace a static IAM key with short-lived SSO credentials on Windows. The classic AWS sign-in form never accepts it.