Description
An AI agent will hand you AWS that deploys, returns CREATE_COMPLETE, and serves a 200, and is quietly wrong: an IAM policy that grants every action on every resource, an S3 bucket the whole internet can read, a database sitting on a public subnet, a Lambda that scans an entire DynamoDB table on every request, an always-on EC2 fleet that should have been serverless, a load balancer per service, an Athena query that scans two terabytes because nobody partitioned the data, a NAT gateway nobody put in the cost estimate, an API key pasted into an environment variable. AWS waves almost all of it through, because the platform is permissive, expensive by default, and insecure the moment you opt out: it deployed, the stack is green, the endpoint answers, and none of that proves the design is safe, the bill is survivable, or the service was even the right one to reach for. Tutorials that walk you through the console do not help here, you are not the one clicking. What you lack is the reviewer’s mental model: what each service actually is, what it costs at scale, and what one leaked key can reach, so you can look at a design and know whether to ship it or send it back.
This book trains you to be the reviewer of vibe-coded AWS, not to memorize the console. It starts from a different premise than every other AWS book: the agent writes the infrastructure, and your edge is understanding the services well enough to judge the architecture, the cost, and the blast radius with the three questions the agent never asks. You’ll learn what the core services really are and when each is the right tool, EC2 and Lambda and the container options for compute, S3 and RDS and DynamoDB and ElastiCache and Redshift for storage and data, Athena and OpenSearch for analytics and search, SQS and SNS and SES for decoupling and email, and Bedrock for AI, and you’ll learn the foundations that decide whether any of it is safe and affordable, IAM least privilege, the VPC and where each tier belongs, how a real HTTPS endpoint is assembled from Route 53 and a certificate and a load balancer, and how to read a bill before it arrives. Every chapter designs a real piece of a working system, gives an illustrative cost estimate, and shows the good-versus-bad architecture an agent would produce, building from a single service to a full design expressed as reviewable infrastructure-as-code with the CDK. There is almost no console clicking here, and a great deal about cost, security, data, and the specific ways an agent’s cloud goes wrong. For engineers who are going to vibe-code on AWS either way and want to be the one who catches the design that would have leaked, broken, or bankrupted them.
Who this was written for
This book is for: engineers who have decided to let an AI agent write their AWS (the CLI commands, the boto3, the CDK) and now own the part the agent cannot, which is judging whether the architecture it produced is secure, affordable, and the right design, and who refuse to spend months clicking through the console and pricing pages to get there.
The one idea that changes everything
The 3 Keys to the Cloud Skill the Best Employers Pay More For. The review that catches the AWS an AI agent got green and got wrong. The stack deploys, the endpoint answers, and none of it proves the design is safe, affordable, or even the right service. Learn to read any cloud with the three questions the agent never asks, and go from the engineer who deploys clouds to the one who signs off on them, before the design that would have leaked, broken, or bankrupted you ever ships.
The full table of contents
- Chapter 1: How I found out that reviewing the cloud, not writing it, was the job
- Chapter 2: The time one misplaced permission taught me AWS
- Chapter 3: What happened when we set up the network wrong
- Chapter 4: Reading the bill before it arrives
- Chapter 5: One wrong setting, and the whole internet reads your data
- Chapter 6: An idle server costs exactly what a busy one does
- Chapter 7: Functions that cost nothing idle, until they hit a wall
- Chapter 8: Why the agent reaches for a Kubernetes you don’t need
- Chapter 9: Your production database, left in the front yard
- Chapter 10: The query that reads a million rows to return five
- Chapter 11: When a cache hides a problem you could fix for free
- Chapter 12: The same answer for five dollars or five thousand
- Chapter 13: Why the browser still says “Not secure”
- Chapter 14: The email that sends twice and the reputation it burns
- Chapter 15: An AI feature with no cap on what it can spend
- Chapter 16: The one line of code that quietly costs $100 a month
- Chapter 17: What happens the second time you run the playbook
- Chapter 18: How I went from deploying clouds to signing off on them
