Amazon Cognito Multi-Region Replication - What Only the Primary Accepts, Which Issuer Your Tokens Carry, and What Validators Must Assume | hidekazu-konishi.com

Draining an Availability Zone for Days - What ARC Zonal Shift Moves and What Stays Pinned to the Zone | hidekazu-konishi.com

Leaving an Amazon DynamoDB Global Table - Disassociation Protection, the Replication Stop Boundary, and Who Acts in Each Account | hidekazu-konishi.com

Model Fallback in Amazon Bedrock AgentCore Gateway - What Triggers It, What the Circuit Breaker Skips, and Why It Stops at the First Byte | hidekazu-konishi.com

Claude Structured Outputs on Amazon Bedrock - Where the Schema Goes, What the Grammar Cache Keeps, and Why stop_reason Comes First | hidekazu-konishi.com

Where a Web Search Domain Filter Is Enforced - Who Can Override It and What Comes Back in Amazon Bedrock, AgentCore Gateway, and Claude's Web Tools | hidekazu-konishi.com

Network Egress in Claude Managed Agents - allowed_hosts, the Package Manager and MCP Switches, and the Two Rules That Stop web_fetch | hidekazu-konishi.com

Which Name the CA Validates - Authorization Domain Names, CNAME Following, and Label Pruning from 2026-11-15 | hidekazu-konishi.com

Web PKI CA Distrust History and Timeline - Who Removed Trust, on What Grounds, and by Which Mechanism | hidekazu-konishi.com

When Intermediate CA Keys Are Compromised - Pushed Blocklists, Compiled-In Denylists, Root Removals, and AWS Trust Bundles | hidekazu-konishi.com

Post-Quantum Certificates for Public TLS Are Three Proposals That Disagree - Merkle Tree Certificates, Pure ML-DSA Chains, Composite Signatures, and Where AWS Fits | hidekazu-konishi.com

Moving a Claude Integration to API Version 2026-10-21 on AWS - Requests That Now Return 400, the Authorization Header, and Amazon Bedrock | hidekazu-konishi.com

What Counts as a Data Plane Action on AWS - IsDataPlane in the Service Reference, CloudTrail Data Events, and What an SCP or RCP Can Scope | hidekazu-konishi.com

Changing the Identity Source in IAM Identity Center Is Not Symmetric - What Survives in Each Direction, and What the Revision Field Guards | hidekazu-konishi.com

Connecting Overlapping Networks on AWS - 1:1 NAT on Transit Gateway and Cloud WAN Attachments, Private NAT Gateways, and the Service Layer | hidekazu-konishi.com

What a Domain Rule Matches in AWS Network Firewall - SNI, the Host Header, and Whether the Resolver Returned the Destination IP | hidekazu-konishi.com

Who Owns the Load Balancer for an Amazon ECS Service - ECS Gateway, an ALB per Service, and Express Mode | hidekazu-konishi.com

Query Auditing in Aurora MySQL and RDS for MySQL - Advanced Auditing, the MariaDB Audit Plugin, and Where Each Audit Log Goes | hidekazu-konishi.com

Calling AWS from Inside Aurora and RDS - aws_lambda, Aurora MySQL's S3 and Lambda Statements, and Which IAM Role Each Uses | hidekazu-konishi.com

Storage Initialization on Amazon RDS - Which Operations Lazy-Load, What StorageOperationStatus Shows, and Who Warms the Volumes | hidekazu-konishi.com