Hero Image
The NAT Gateway 'Trick' That Was Actually Billing You for ECR, Not S3

A client’s NAT Gateway bill hit a record ~$3,000/month. VPC Flow Logs pointed straight at S3 — except the client swore they barely used S3. Here’s what was actually going on. Hi everyone 👋 A client came to us about a month after going live with a new system built by a different vendor — one they no longer had a maintenance contract with. Their first full invoice after launch showed a NAT Gateway bill at a record high, roughly $3,000/month. Standard architecture on their end: ECS services running in private subnets for security, NAT Gateway for outbound access. Textbook setup on paper — which made a bill that high, right out of the gate, more confusing, not less.

Thursday, June 18, 2026 Read
Hero Image
The MTU 9001 Trap: Flaky Connections Over VPC Peering and VPN

Ping works. SSH works. But the moment the app sends a large payload over VPN or cross-region peering, it just… hangs. This is why. Hi everyone 👋 This is a classic debugging trap that can burn a new DevOps engineer several days, precisely because the system never throws a clear error log. 😱 The confusing symptom Two EC2 instances in different VPCs, connected over VPC peering, VPN, or Direct Connect. Ping between them responds fine. SSH works fine too. But the moment the application transfers a large file, or sends a long JSON payload over an API call on that same connection, the request hangs indefinitely until it eventually times out.

Friday, February 20, 2026 Read
Hero Image
The Hidden Cost of Cross-AZ Data Transfer on AWS

Multi-AZ for high availability quietly turned into a network bill bigger than the compute bill — here’s why. Hi everyone 👋 This is one of those “hidden landmines” on AWS: things that never throw a clear error, never show up in a StackOverflow top answer, but can quietly make a system flaky or burn thousands of dollars a month. First up: cross-AZ data transfer. 😱 The assumption that gets everyone Everyone knows data transfer out to the internet costs money. Far fewer people realize that traffic between Availability Zones inside the same Region isn’t free either — a lot of us assume “it’s all internal, so it’s free.”

Wednesday, January 14, 2026 Read