AWS - Practical insights for IT professionals

AWS Deprecation That Exposed Years of Inherited Infrastructure Debt

08/11/2026 by Serhii Matiushchenko

Reading Time: 4 minutesWhen AWS announced the retirement of the old ec2messages endpoint, it turned out the problem wasn’t just an outdated SSM Agent. This is a story about inherited infrastructure: a 2017 IAM policy that still showed green in the console, and a Terraform module that, if updated the “proper” way, threatened to destroy the storage volumes of a live production cluster. Sometimes the most honest choice is to deliberately leave technical debt in place — rather than force the correct fix and risk breaking everything.

We Thought This Workload Was Using IRSA. It Never Was

08/11/202607/10/2026 by Serhii Matiushchenko

Reading Time: 2 minutesDuring a least-privilege cleanup I discovered that a workload we believed was using IRSA had actually been running on the node IAM role for almost a year. Here’s how it was found and what changed in my verification process.

How Our Nginx Watchdog Missed the Outage It Was Built to Catch

08/11/202606/05/2026 by Serhii Matiushchenko

Reading Time: 6 minutesWe built a watchdog to automatically reload nginx whenever it started timing out against an AWS ALB — the classic “cached a stale IP” problem. It worked… until a different domain on the same box went down for hours while the script sat there happily reporting that everything was fine. This is the story of how a monitoring gap, a partial deploy, and a threshold tuned for the wrong failure shape turned a good idea into false confidence — and what it took to fix the class of problem instead of just the one instance that had already bitten us.

The Firewall Rule That Blocked an IP, and Nothing Else

08/12/202604/08/2026 by Serhii Matiushchenko

Reading Time: 3 minutesBlocking an attacker’s IP address stopped nothing, because the address hitting the edge was never the attacker’s own. The same flood kept coming back seconds later from a brand-new address, one hop further back than the block was looking.

Three SSH Keys, and Only One of Them Was Telling the Truth

08/12/202603/03/2026 by Serhii Matiushchenko

Reading Time: 3 minutesA routine rolling node replacement turned into a lesson in credential archaeology, with three plausible SSH keys and only one of them actually working, none of the mismatch visible until someone tried to connect under a maintenance-window clock.

Terraform Plan That Wanted to Roll Back Nothing Into Something Worse

08/12/202602/12/2026 by Serhii Matiushchenko

Reading Time: 3 minutesA routine version bump turned into a plan that quietly proposed rolling several production databases backward instead of forward. The infrastructure code hadn’t drifted because someone made a mistake; the databases had simply been patched by the cloud provider without anyone updating the code to match.

The New Server That Was Secretly the Old Server

08/12/202601/05/2026 by Serhii Matiushchenko

Reading Time: 3 minutesA golden image saved us from reinstalling the security agent on every new server, until a handful of freshly launched machines started reporting under the identity of a server that no longer existed. One skipped step during image creation, and the console couldn’t tell the machines apart.